# CVE-2025-60685: ToToLink A720R stack buffer overflow in sysconf binary

Source: https://junglewise.ai/threats/cve-2025-60685-totolink-a720r-stack-buffer-overflow-in-sysconf-binary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60685 · Severity: medium · CVSS 5.1 · Published 2025-11-13

A security vulnerability exists in the ToToLink A720R router, a device used to provide wireless internet connectivity. An attacker with the ability to modify local system files could trigger a crash or potentially take control of the device's operating system. This could lead to a complete disruption of internet services or unauthorized access to the router's internal functions.

Technologies: [TOTOLINK A720r](https://junglewise.ai/threats/technologies/a720r), [TOTOLINK A720r Firmware](https://junglewise.ai/threats/technologies/a720r-firmware). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2025-60685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60685 being exploited in the wild.

**How severe is CVE-2025-60685?** Medium severity, with a CVSS score of 5.1, published 13 November 2025.

**Which products and versions are affected?** TOTOLINK A720r Firmware V4.1.5cu.614_B20230630.

**Is there a fix for CVE-2025-60685?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60685 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2025-60685?** Check whether you run TOTOLINK A720r or TOTOLINK A720r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'sysconf' binary of the ToToLink A720R router (firmware V4.1.5cu.614_B20230630) within the sub_401EE0 function. The vulnerability is caused by the unsafe use of sscanf() with a %s format specifier when parsing data read from /proc/stat via fgets(). Specifically, the binary attempts to write string data into a single-byte char variable (v23), leading to an overflow of adjacent stack memory. An attacker with local filesystem write privileges or the ability to influence the contents of /proc/stat can exploit this to overwrite the return address and achieve arbitrary code execution.

## Affected products

- ToToLink A720R Router firmware V4.1.5cu.614_B20230630

## Timeline

- 2025-11-13: disclosed: Initial disclosure of CVE-2025-60685
- 2025-11-13: advisory

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60685.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60685.md)
- [https://www.totolink.net/](https://www.totolink.net/)

## Related threats

- [TOTOLINK A720R stack buffer overflow in MAC filtering](https://junglewise.ai/threats/cve-2026-82539-totolink-a720r-stack-buffer-overflow-in-mac-filtering)
- [ToToLink Routers stack overflow in infostat.cgi and cstecgi.cgi](https://junglewise.ai/threats/cve-2025-60686-totolink-routers-stack-overflow-in-infostat-cgi-and-cstecgi-cgi)
- [ToToLink A720R command injection in sysconf binary](https://junglewise.ai/threats/cve-2025-60683-totolink-a720r-command-injection-in-sysconf-binary)
- [ToToLink A720R command injection in cloudupdate_check](https://junglewise.ai/threats/cve-2025-60682-totolink-a720r-command-injection-in-cloudupdate-check)