CVE-2025-28036: Critical Vulnerability in TOTOLINK A950RG Enables Remote Command Execution

Overview

The cybersecurity landscape is constantly evolving with new threats and vulnerabilities discovered every day. One such vulnerability, CVE-2025-28036, was discovered in TOTOLINK A950RG V4.1.2cu.5161_B20200903. This vulnerability, if exploited, allows remote command execution on the affected device. It is a critical issue as it affects TOTOLINK A950RG routers, commonly used in home and small business environments. The exploit enables potential system compromise or data leakage, making it a significant threat to the security and privacy of users.

Vulnerability Summary

CVE ID: CVE-2025-28036
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise, Data Leakage

Affected Products

Product | Affected Versions

TOTOLINK A950RG | V4.1.2cu.5161_B20200903

How the Exploit Works

The vulnerability lies in the setNoticeCfg function of the TOTOLINK A950RG’s firmware. This function can be accessed without any authentication, and the NoticeUrl parameter is susceptible to remote command execution. An attacker can send a crafted HTTP request with malicious commands to the NoticeUrl parameter, which the function will execute. This gives the attacker the ability to execute arbitrary commands on the device, potentially leading to system compromise or data leakage.

Conceptual Example Code

A conceptual example of exploiting this vulnerability might look like the following HTTP request, where “{malicious_command}” represents an attacker’s command:

POST /setNoticeCfg HTTP/1.1
Host: vulnerable_router
Content-Type: application/json
{ "NoticeUrl": "{malicious_command}" }

In this example, the malicious_command is injected into the NoticeUrl parameter of the setNoticeCfg function, which, due to the vulnerability, executes the command. This can lead to a range of harmful actions, from unauthorized data access to a complete system compromise.

Mitigation Guidance

Users of affected versions of the TOTOLINK A950RG should apply the vendor-provided patch as soon as possible. If the patch cannot be applied immediately, users are advised to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation. These can help detect and prevent attempts to exploit this vulnerability. Additionally, users should always ensure their devices are running the latest firmware versions to protect against potential security threats.