CVE Feed

    Dashboard / CVE / CVE-2025-60702

    CVE-2025-60702

    A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

    Published:Nov 13, 2025
    Last Modified:Nov 18, 2025
    EPS:Nov 13, 2025
    EPSS Score:0.00092
    CVSS Score:6.5

    Affected Products

    Vendor
    Totolink
    Product
    A950rg
    Vendor
    Totolink
    Product
    A950rg Firmware

    Exploits

    https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60702.md

    Related CVEs

    CVE-2026-15271 (CVSS 7.7) — A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 a…
    CVE-2025-67187 (CVSS 9.8) — A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The fla…
    CVE-2025-67188 (CVSS 9.8) — A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the se…
    CVE-2025-67186 (CVSS 9.8) — TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules inte…
    CVE-2025-67189 (CVSS 6.5) — A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B202…
    CVE-2025-60699 (CVSS 6.5) — A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within …
    CVE-2025-44655 (CVSS 9.8) — In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.con…
    CVE-2025-4496 (CVSS 8.7) — A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210…
    CVE-2025-45798 (CVSS 9.8) — A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is …
    CVE-2025-45797 (CVSS 9.8) — TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises fro…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High