CVE-2025-60686: ToToLink Routers stack overflow in infostat.cgi and cstecgi.cgi

CVE-2025-60686 · Severity: medium · CVSS 5.1 · Published 2025-11-13

A security vulnerability exists in several ToToLink router models, which are devices used to provide internet connectivity and manage home or office networks. If an attacker gains local access to the device's file system, they can exploit a flaw in how the router processes internal network status files. This could allow the attacker to crash the device or potentially take control of it, leading to a loss of internet service or unauthorized access to the router's settings.

Technologies: TOTOLINK A720r, TOTOLINK A720r Firmware, TOTOLINK Lr1200gb Firmware. Vendors: TOTOLINK.

Quick answers

Is CVE-2025-60686 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-60686 being exploited in the wild.
How severe is CVE-2025-60686?
Medium severity, with a CVSS score of 5.1, published 13 November 2025.
Which products and versions are affected?
TOTOLINK A720r Firmware V4.1.5cu.614_B20230630; TOTOLINK Lr1200gb Firmware V9.1.0u.6619_B20230130.
Is there a fix for CVE-2025-60686?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60686 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2025-60686?
Check whether you run TOTOLINK A720r, TOTOLINK A720r Firmware or TOTOLINK Lr1200gb Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a stack-based buffer overflow (CWE-121) located in the infostat.cgi and cstecgi.cgi binaries. The root cause is the use of sscanf() with the '%s' format specifier to parse the contents of /proc/net/arp into fixed-size stack buffers without length validation. In infostat.cgi, data is written into a single-byte char buffer, while in cstecgi.cgi, data is written into adjacent small arrays. An attacker with the ability to control the contents of /proc/net/arp or manipulate the filesystem (e.g., via a symbolic link to a malicious file) can trigger memory corruption. This can lead to a denial of service (DoS) or potential arbitrary code execution under the context of the web server. The vulnerability requires local access or a prerequisite exploit to modify the local environment.

Affected products

  • ToToLink A720R Firmware V4.1.5cu.614_B20230630
  • ToToLink LR1200GB Firmware V9.1.0u.6619_B20230130
  • ToToLink NR1800X Firmware V9.1.0u.6681_B20230703

Timeline

  • 2025-11-13: advisory: NVD Published Date
  • 2025-11-13: disclosed: Public disclosure of the vulnerability and PoC

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.