CVE-2025-28039

Summary

CVE-2025-28039 is a pre-authentication remote command execution vulnerability affecting the TOTOLINK EX1200T V4.1.2cu.5232_B20210713 firmware. The issue was discovered in the setUpgradeFW function, which can be exploited through the FileName parameter without requiring valid authentication credentials. Successful exploitation allows an attacker to execute arbitrary commands on the affected device, potentially leading to significant security compromises. It is recommended that users upgrade to the latest vulnerable-free firmware version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.