CVE-2025-28138: Totolink a800r Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

Affected products

• Totolink a800r Firmware: version 4.1.2cu.5137_b20200730 only

Published 2025-03-27. Last modified 2026-06-17.