CVE-2025-60702
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
A command injection vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input and concatenates it directly into a ping command without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.
Risk Assessment
An unauthenticated attacker could execute arbitrary commands on the device, take control of it, and use it for further attacks on the network.
Recommendation
Update the TOTOLINK A950RG router firmware to the latest version if a patch is available. Until then, restrict access to the router's web interface to trusted networks.
Other vulnerabilities in TOTOLINK A950RG
See all- CVE-2026-121597Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi mishandles the functionType argument, leading to a stack-based buffer overflow. The attack can be performed remotely and a public exploit is available.
- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-116504Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-114575Critical
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.
- CVE-2026-116507Medium
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the getLanguageCfg function in global.so discloses information when the token argument is manipulated. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2025-60699Medium
A buffer overflow vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the global.so binary. The getSaveConfig function retrieves the http_host parameter and copies it into a fixed-size stack buffer using strcpy() without length checks, potentially leading to arbitrary code execution by an unauthenticated remote attacker.
Original NVD description (English source)
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS