← Vulnerability feed

Vulnerability record · CVE-2025-60686 · published 13 November 2025

CVE-2025-60686: Totolink a720r firmware stack-based buffer overflow vulnerability

TTotolink · A720r Firmware

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation. Specifically, one function writes user-controlled data into a single-byte buffer, and the other into adjacent small arrays without bounds checking. An attacker who controls the contents of /proc/net/arp can trigger memory corruption, leading to denial of service or potential arbitrary code execution.

5.1 CVSS 3.1 Medium EPSS 0.24% · top 86.2% CWE-121 · Stack-based buffer overflow
5.1CVSS 3.1 base score
0.24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References, 1 tagged exploit
5 Jul 2026Last modified by NVD

Description

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation. Specifically, one function writes user-controlled data into a single-byte buffer, and the other into adjacent small arrays without bounds checking. An attacker who controls the contents of /proc/net/arp can trigger memory corruption, leading to denial of service or potential arbitrary code execution.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60686.md ExploitThird Party Advisory
https://www.totolink.net/ Product

Track CVE-2025-60686 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-45841Totolink nr1800x firmware out-of-bounds write vulnerabilityTOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.EPSS 0.53%9.8CVE-2024-1783Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function logi…EPSS 2.0%9.8CVE-2024-0578Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the …EPSS 1.1%9.8CVE-2024-0577Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function setLanguageCfg o…EPSS 0.99%9.8CVE-2024-0576Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been declared as critical. This vulnerability affects the function setIp…EPSS 0.99%9.8CVE-2024-0575Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been classified as critical. This affects the function setTracerouteCfg …EPSS 1.1%9.8CVE-2024-0574Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this issue is the function setParentalRu…EPSS 1.1%9.8CVE-2024-0573Totolink lr1200gb firmware stack-based buffer overflow vulnerabilityA vulnerability has been found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this vulnerability is the function …EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2025-60686), CISA KEV, FIRST EPSS (scores of 2026-10-16). This page is refreshed as NVD updates the record.