CVE-2025-28032: totolink a3000ru_firmware Stack-based Buffer Overflow

Vulnerability summary

CVE-2025-28032 is a high (CVSS 7.3) Stack-based Buffer Overflow vulnerability in totolink a3000ru_firmware. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-04-2025
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parameter.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).