CVE Feed

    Dashboard / CVE / CVE-2025-60699

    CVE-2025-60699

    A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.

    Published:Nov 13, 2025
    Last Modified:Nov 18, 2025
    EPS:Nov 13, 2025
    EPSS Score:0.00323
    CVSS Score:6.5

    Affected Products

    Vendor
    Totolink
    Product
    A950rg
    Vendor
    Totolink
    Product
    A950rg Firmware

    Exploits

    https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60699.md

    Common Weakness Enumeration

    CWE-121 Stack-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-15271 (CVSS 7.7) — A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 a…
    CVE-2025-67187 (CVSS 9.8) — A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The fla…
    CVE-2025-67188 (CVSS 9.8) — A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the se…
    CVE-2025-67186 (CVSS 9.8) — TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules inte…
    CVE-2025-67189 (CVSS 6.5) — A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B202…
    CVE-2025-60702 (CVSS 6.5) — A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL withi…
    CVE-2025-44655 (CVSS 9.8) — In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.con…
    CVE-2025-4496 (CVSS 8.7) — A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210…
    CVE-2025-45798 (CVSS 9.8) — A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is …
    CVE-2025-45797 (CVSS 9.8) — TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises fro…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High