CVE-2025-60683: Command Injection
A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the sysconf binary, specifically in the sub40BFA4 function that handles network interface reinitialization from '/var/system/linuxvlanreinit'. Input is only partially validated by checking the prefix of interface names, and is concatenated into shell commands executed via system() without escaping. An attacker with write access to this file can execute arbitrary commands on the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60683?
CVE-2025-60683 is classified as high severity due to its potential to allow command injection on vulnerable router firmware.
How do I fix CVE-2025-60683?
To fix CVE-2025-60683, it is recommended to upgrade the ToToLink A720R Router firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2025-60683?
CVE-2025-60683 is a command injection vulnerability affecting firmware functionality.
Which routers are affected by CVE-2025-60683?
CVE-2025-60683 specifically affects the ToToLink A720R Router running firmware version 4.1.5cu.614_B20230630.
How can CVE-2025-60683 be exploited?
CVE-2025-60683 can be exploited by sending specially crafted inputs to the sysconf binary during network interface reinitialization.