Is CVE-2025-60684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60684 being exploited in the wild.

How severe is CVE-2025-60684?

Medium severity, with a CVSS score of 6.5, published 13 November 2025.

Which products and versions are affected?

TOTOLINK Lr1200gb V9.1.0u.6619_B20230130; TOTOLINK Nr1800x V9.1.0u.6681_B20230703.

Is there a fix for CVE-2025-60684?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60684 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-60684?

Check whether you run TOTOLINK Lr1200gb, TOTOLINK Lr1200gb Firmware, TOTOLINK Nr1800x or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60684: ToToLink Routers stack buffer overflow in cstecgi.cgi

CVE-2025-60684 · Severity: medium · CVSS 6.5 · Published 2025-11-13

A security vulnerability exists in the firmware of ToToLink LR1200GB and NR1800X routers, which are devices used to provide home and office internet connectivity. An attacker can exploit the router's web management interface to cause a system crash or potentially take control of the device. This attack can be performed remotely without needing a username or password, potentially disrupting internet service or compromising the security of the local network.

Technologies: TOTOLINK Lr1200gb, TOTOLINK Lr1200gb Firmware, TOTOLINK Nr1800x, TOTOLINK Nr1800x Firmware. Vendors: TOTOLINK.

Quick answers

Is CVE-2025-60684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60684 being exploited in the wild.
How severe is CVE-2025-60684?: Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?: TOTOLINK Lr1200gb V9.1.0u.6619_B20230130; TOTOLINK Nr1800x V9.1.0u.6681_B20230703.
Is there a fix for CVE-2025-60684?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60684 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-60684?: Check whether you run TOTOLINK Lr1200gb, TOTOLINK Lr1200gb Firmware, TOTOLINK Nr1800x or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow vulnerability exists in the cstecgi.cgi binary (specifically within the sub_42F32C function) of ToToLink LR1200GB and NR1800X routers. The vulnerability is caused by the unsafe use of the sprintf() function when processing the 'lang' and 'HelpUrl' parameters retrieved via websGetVar(). The application fails to validate the length of these user-supplied strings before copying them into a fixed-size 128-byte stack buffer (v7). An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi, leading to memory corruption, denial of service, or potential remote code execution. As of the advisory date, no official patch has been confirmed.

Affected products

ToToLink LR1200GB firmware V9.1.0u.6619_B20230130
ToToLink NR1800X firmware V9.1.0u.6681_B20230703

Timeline

2025-11-13: advisory: NVD published the CVE record
2025-11-13: disclosed: Public PoC published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.