CVE-2025-60685: Buffer Overflow
A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the sysconf binary (sub401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60685?
CVE-2025-60685 is classified as a high severity vulnerability due to the potential stack buffer overflow that can lead to code execution.
How do I fix CVE-2025-60685?
To mitigate CVE-2025-60685, update the ToToLink A720R Router firmware to the latest version that addresses this vulnerability.
What is affected by CVE-2025-60685?
CVE-2025-60685 impacts the ToToLink A720R Router firmware version V4.1.5cu.614_B20230630.
How does CVE-2025-60685 occur?
CVE-2025-60685 occurs when the sysconf binary improperly handles user input from the /proc/stat file, leading to a buffer overflow.
Is CVE-2025-60685 exploitable remotely?
Yes, CVE-2025-60685 is considered exploitable remotely, allowing an attacker to execute arbitrary code on the affected device.