← Vulnerability feed

Vulnerability record · CVE-2025-60684 · published 13 November 2025

CVE-2025-60684: Totolink lr1200gb firmware stack-based buffer overflow vulnerability

TTotolink · Lr1200gb Firmware

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.

6.5 CVSS 3.1 Medium EPSS 0.55% · top 55.4% CWE-121 · Stack-based buffer overflow
6.5CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References, 1 tagged exploit
5 Jul 2026Last modified by NVD

Description

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60684.md ExploitThird Party Advisory
https://www.totolink.net/ Product

Track CVE-2025-60684 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-45841Totolink nr1800x firmware out-of-bounds write vulnerabilityTOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.EPSS 0.53%9.8CVE-2024-1783Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function logi…EPSS 2.0%9.8CVE-2024-0578Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the …EPSS 1.1%9.8CVE-2024-0577Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function setLanguageCfg o…EPSS 0.99%9.8CVE-2024-0576Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been declared as critical. This vulnerability affects the function setIp…EPSS 0.99%9.8CVE-2024-0574Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this issue is the function setParentalRu…EPSS 1.1%9.8CVE-2024-0575Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been classified as critical. This affects the function setTracerouteCfg …EPSS 1.1%9.8CVE-2024-0573Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability has been found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this vulnerability is the function …EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2025-60684), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.