Executive brief
A security vulnerability exists in several ToToLink router models, which are devices used to provide internet connectivity and manage home or office networks. If an attacker gains local access to the device's file system, they can exploit a flaw in how the router processes internal network status files. This could allow the attacker to crash the device or potentially take control of it, leading to a loss of internet service or unauthorized access to the router's settings.
Technical details
This vulnerability is a stack-based buffer overflow (CWE-121) located in the infostat.cgi and cstecgi.cgi binaries. The root cause is the use of sscanf() with the '%s' format specifier to parse the contents of /proc/net/arp into fixed-size stack buffers without length validation. In infostat.cgi, data is written into a single-byte char buffer, while in cstecgi.cgi, data is written into adjacent small arrays. An attacker with the ability to control the contents of /proc/net/arp or manipulate the filesystem (e.g., via a symbolic link to a malicious file) can trigger memory corruption. This can lead to a denial of service (DoS) or potential arbitrary code execution under the context of the web server. The vulnerability requires local access or a prerequisite exploit to modify the local environment.
Affected products
- ToToLink A720R Firmware V4.1.5cu.614_B20230630
- ToToLink LR1200GB Firmware V9.1.0u.6619_B20230130
- ToToLink NR1800X Firmware V9.1.0u.6681_B20230703
Timeline
- 2025-11-13: advisory: NVD Published Date
- 2025-11-13: disclosed: Public disclosure of the vulnerability and PoC