CVE-2025-60702: A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the…
CVE-2025-60702 · Severity: medium · CVSS 6.5 · Published 2025-11-13
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
No. Junglewise Threat Intelligence has no report of CVE-2025-60702 being exploited in the wild.
How severe is CVE-2025-60702?
Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?
TOTOLINK A950rg, TOTOLINK A950rg Firmware. The advisory does not name versions.
Is there a fix for CVE-2025-60702?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-60702?
Check whether you run TOTOLINK A950rg or TOTOLINK A950rg Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.