Remote Command Execution Vulnerability in TOTOLINK Routers
CVE-2025-28037

9.8CRITICAL

Key Information:

Vendor
TOTOLINK
Status
A810R and A950RG Routers
Vendor
CVE Published:
22 April 2025

Summary

TOTOLINK routers, specifically the A810R and A950RG models, have a vulnerability in the setDiagnosisCfg function that allows for pre-authentication remote command execution via the ipDomain parameter. This weakness could potentially enable attackers to execute arbitrary commands on the affected devices without prior authentication, leading to unauthorized access and control.

References

https://locrian-lightning-dc7.notion.site/RCE3-1ad8e5e2b1...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.