CVE-2025-60699: Buffer Overflow
A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the global.so binary. The getSaveConfig function retrieves the httphost parameter from user input via websGetVar and copies it into a fixed-size stack buffer (v13) using strcpy() without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60699?
CVE-2025-60699 is rated as a high-severity vulnerability due to its potential for exploitation via remote code execution.
How do I fix CVE-2025-60699?
To mitigate CVE-2025-60699, users should update the TOTOLINK A950RG Router firmware to the latest version provided by the vendor.
What systems are affected by CVE-2025-60699?
CVE-2025-60699 specifically affects the TOTOLINK A950RG Router firmware version 5.9c.4592_B20191022.
What is the impact of exploiting CVE-2025-60699?
Exploitation of CVE-2025-60699 could allow an attacker to execute arbitrary code on the affected router.
How is CVE-2025-60699 exploited?
CVE-2025-60699 can be exploited through a buffer overflow in the `getSaveConfig` function due to improper handling of user input.