PT-2025-17647 · Totolink · Totolink A800R

Published 2025-04-23 · Updated 2025-05-06 · CVE-2025-28018

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730

Description A buffer overflow vulnerability was found in the downloadFile.cgi endpoint through the v14 parameter. This issue allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For TOTOLINK A800R version 4.1.2cu.5137 B20200730, consider disabling access to the downloadFile.cgi endpoint until a patch is available. Avoid using the v14 parameter in the downloadFile.cgi endpoint to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-07812

CVE-2025-28018

Affected Products

Totolink A800R

References · 8

• 🔥 https://locrian-lightning-dc7.notion.site/BufferOverflow2-1948e5e2b1a28070a8d1d1ba725febff · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28018 · Security Note
• https://bdu.fstec.ru/vul/2025-07812 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28018 · Vendor Advisory
• https://vuldb.com/?id.306018 · Note
• https://t.me/cvenotify/121113 · Telegram Post
• https://twitter.com/CVEnew/status/1915091919371391307 · Twitter Post
• https://twitter.com/cracbot/status/1916809688475185599 · Twitter Post