CVE-2025-60702: Command Injection

Published Nov 13, 2025

Updated

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and concatenates it directly into a ping system command executed via CsteSystem() without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Affected Software

3 affected components

TOTOLINK A950RG Router

All of the following

TOTOLINK A950rg Firmware=5.9c.4592_b20191022

TOTOLINK A950RG

Event History

Nov 13, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60702?

CVE-2025-60702 is classified as a critical command injection vulnerability.

How do I fix CVE-2025-60702?

To fix CVE-2025-60702, update the TOTOLINK A950RG Router firmware to the latest version provided by the vendor.

What devices are affected by CVE-2025-60702?

CVE-2025-60702 affects the TOTOLINK A950RG Router running firmware version 5.9c.4592_B20191022.

What can attackers do with CVE-2025-60702?

Attackers can exploit CVE-2025-60702 to execute arbitrary commands on the affected router.

Is there a workaround for CVE-2025-60702?

Currently, the recommended action is to update the firmware, as no official workaround is available for CVE-2025-60702.