Is CVE-2025-60683 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60683 being exploited in the wild.

How severe is CVE-2025-60683?

Medium severity, with a CVSS score of 6.5, published 13 November 2025.

Which products and versions are affected?

TOTOLINK A720r V4.1.5cu.614_B20230630.

Is there a fix for CVE-2025-60683?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60683 attacked?

It is attacked over the network or with local access, in device firmware.

Am I affected by CVE-2025-60683?

Check whether you run TOTOLINK A720r or TOTOLINK A720r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60683: ToToLink A720R command injection in sysconf binary

CVE-2025-60683 · Severity: medium · CVSS 6.5 · Published 2025-11-13

A security vulnerability exists in the ToToLink A720R router, a device used to provide wireless internet connectivity. An attacker who can modify a specific system configuration file can take full control of the device by executing unauthorized commands. This could lead to the interception of network traffic, unauthorized access to connected devices, or a complete disruption of internet service.

Technologies: TOTOLINK A720r, TOTOLINK A720r Firmware. Vendors: TOTOLINK.

Quick answers

Is CVE-2025-60683 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60683 being exploited in the wild.
How severe is CVE-2025-60683?: Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?: TOTOLINK A720r V4.1.5cu.614_B20230630.
Is there a fix for CVE-2025-60683?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60683 attacked?: It is attacked over the network or with local access, in device firmware.
Am I affected by CVE-2025-60683?: Check whether you run TOTOLINK A720r or TOTOLINK A720r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the 'sysconf' binary of ToToLink A720R firmware version V4.1.5cu.614_B20230630. The flaw is located in the sub_40BFA4 function, which reads network interface reinitialization data from the file '/var/system/linux_vlan_reinit'. The application performs insufficient validation by only checking if the input starts with 'eth' or 'wlan' before passing the string to the system() function via sub_40AC08. An attacker who can write to this file can use shell metacharacters (e.g., semicolons) to bypass the prefix check and execute arbitrary system commands. While the vulnerability requires the ability to write to a local file, the CVSS vector provided by CISA-ADP suggests potential network-based vectors for exploitation.

Affected products

ToToLink A720R V4.1.5cu.614_B20230630

Timeline

2025-11-13: advisory: Initial disclosure and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.