CVE-2025-28137: Critical RCE in TOTOLINK A810R Router

CVE-2025-28137 is a pre-authenticated remote command execution (RCE) vulnerability in the TOTOLINK A810R router version V4.1.2cu.5182_B20201026. The flaw resides in the setNoticeCfg function and is exploitable via the NoticeUrl parameter without authentication. A remote attacker can execute arbitrary commands on the device, fully compromising it and potentially affecting the entire connected network segment.

The assigned CVSS score is 9.8 with a critical rating. The vulnerability was officially published on 2025-04-15. A verified and recent fact: on 2026-10-30, public GitHub repositories were identified claiming to contain exploit code for this vulnerability. This signal indicates that exploitation code is now widely available, significantly increasing the risk of active attacks in the coming days.

Sysadmins and IT teams must immediately verify if they have TOTOLINK A810R devices in production. If present, priority actions are applying firmware updates from the vendor, if available. In the interim, logical or physical isolation of affected routers, blocking unnecessary remote access, and active monitoring of system and network logs to detect exploitation attempts are recommended. Contact the vendor for patch availability and timelines.