Cyber Posture

CVE-2025-28135

HighPublic PoC

Published: 27 March 2025

Published
27 March 2025
Modified
15 April 2025
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0034 57.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-28135 is a buffer overflow vulnerability, classified under CWE-121, affecting the TOTOLINK A810R router on firmware version V4.1.2cu.5182_B20201026. The flaw exists in the downloadFile.cgi component, as disclosed on March 27, 2025, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

An unauthenticated remote attacker with network access to the device can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation results in a denial-of-service condition, causing high availability impact through device crash or disruption, while confidentiality and integrity remain unaffected.

Advisories and additional details are available in the following references: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28135.md and https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5182_B20201026-19872b8cd95f80808902fac8449fee64.

Details

CWE(s)
CWE-121

Affected Products

totolink
a810r firmware
4.1.2cu.5182_b20201026

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated buffer overflow in web CGI component (downloadFile.cgi) of public-facing router enables exploitation of public-facing application for DoS impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References