PT-2025-17650 · Totolink · Totolink A810R

Published 2025-04-23 · Updated 2025-04-28 · CVE-2025-28022

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TOTOLINK A810R version 4.1.2cu.5182 B20201026

Description A buffer overflow issue was discovered in the downloadFile.cgi endpoint through the v25 parameter.

Recommendations For TOTOLINK A810R version 4.1.2cu.5182 B20201026, avoid using the v25 parameter in the "downloadFile.cgi" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the downloadFile.cgi endpoint to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-10010

CVE-2025-28022

Affected Products

Totolink A810R

References · 8

• 🔥 https://locrian-lightning-dc7.notion.site/CVE-2025-28022-BufferOverflow3-1948e5e2b1a280ec8061ed308b33b5bc · Exploit
• 🔥 https://locrian-lightning-dc7.notion.site/BufferOverflow3-1948e5e2b1a280ec8061ed308b33b5bc?pvs=73 · Exploit
• https://osv.dev/vulnerability/CVE-2025-28022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-28022 · Security Note
• https://github.com/advisories/ghsa-h5q7-f44m-25fc · Note
• https://twitter.com/CVEnew/status/1915091923498635303 · Twitter Post
• https://twitter.com/cracbot/status/1916809695081140599 · Twitter Post