# CVE-2025-60682: ToToLink A720R command injection in cloudupdate_check

Source: https://junglewise.ai/threats/cve-2025-60682-totolink-a720r-command-injection-in-cloudupdate-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60682 · Severity: medium · CVSS 6.5 · Published 2025-11-13

A security vulnerability exists in the ToToLink A720R router, a device used to provide wireless internet connectivity. An unauthenticated attacker can remotely send specially crafted requests to the router's update mechanism to take control of the device. This could allow an attacker to intercept network traffic, disrupt internet service, or use the router as a foothold to attack other devices on the local network.

Technologies: [TOTOLINK A720r](https://junglewise.ai/threats/technologies/a720r), [TOTOLINK A720r Firmware](https://junglewise.ai/threats/technologies/a720r-firmware). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2025-60682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60682 being exploited in the wild.

**How severe is CVE-2025-60682?** Medium severity, with a CVSS score of 6.5, published 13 November 2025.

**Which products and versions are affected?** TOTOLINK A720r V4.1.5cu.614_B20230630.

**Is there a fix for CVE-2025-60682?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60682 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-60682?** Check whether you run TOTOLINK A720r or TOTOLINK A720r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the 'cloudupdate_check' binary of the ToToLink A720R router, specifically within the sub_402414 function. The application uses 'websGetVar' to retrieve the 'magicid' and 'url' parameters from a POST request to '/cgi-bin/cloud_update.cgi'. These user-supplied values are directly concatenated into a command string via 'snprintf' and subsequently executed using the 'system()' function without any sanitization or escaping of shell metacharacters. An unauthenticated remote attacker can exploit this by injecting shell commands (e.g., using semicolons) into these parameters to achieve arbitrary code execution with the privileges of the web service. A Proof of Concept (PoC) demonstrating the injection via the 'magicid' and 'url' fields has been publicly disclosed.

## Affected products

- ToToLink A720R Router V4.1.5cu.614_B20230630

## Timeline

- 2025-11-13: advisory: Initial NVD publication date
- 2025-11-13: disclosed: Public disclosure of PoC on GitHub

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60682.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60682.md)
- [https://www.totolink.net/](https://www.totolink.net/)

## Related threats

- [TOTOLINK A720R stack buffer overflow in MAC filtering](https://junglewise.ai/threats/cve-2026-82539-totolink-a720r-stack-buffer-overflow-in-mac-filtering)
- [ToToLink Routers stack overflow in infostat.cgi and cstecgi.cgi](https://junglewise.ai/threats/cve-2025-60686-totolink-routers-stack-overflow-in-infostat-cgi-and-cstecgi-cgi)
- [ToToLink A720R stack buffer overflow in sysconf binary](https://junglewise.ai/threats/cve-2025-60685-totolink-a720r-stack-buffer-overflow-in-sysconf-binary)
- [ToToLink A720R command injection in sysconf binary](https://junglewise.ai/threats/cve-2025-60683-totolink-a720r-command-injection-in-sysconf-binary)