CVE-2025-60699
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A buffer overflow vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the global.so binary. The getSaveConfig function retrieves the http_host parameter and copies it into a fixed-size stack buffer using strcpy() without length checks, potentially leading to arbitrary code execution by an unauthenticated remote attacker.
Risk Assessment
An unauthenticated attacker could trigger a buffer overflow and potentially execute arbitrary code on the device, taking control of it.
Recommendation
Update the TOTOLINK A950RG router firmware to the latest version if a patch is available. Until then, restrict access to the router's web interface to trusted networks.
Other vulnerabilities in TOTOLINK A950RG
See all- CVE-2026-121597Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi mishandles the functionType argument, leading to a stack-based buffer overflow. The attack can be performed remotely and a public exploit is available.
- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-116504Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-114575Critical
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.
- CVE-2026-116507Medium
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the getLanguageCfg function in global.so discloses information when the token argument is manipulated. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2025-60702Medium
A command injection vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input and concatenates it directly into a ping command without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.
Original NVD description (English source)
A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS