Command Injection Flaw in ToToLink A720R Router Firmware
CVE-2025-60682
6.5MEDIUM
What is CVE-2025-60682?
The ToToLink A720R Router firmware contains a command injection vulnerability in the cloud update check functionality. Specifically, the flaw exists in how the firmware processes user-supplied inputs, such as 'magicid' and 'url'. These inputs are concatenated directly into shell commands and executed via the system() function without proper sanitization or escaping. This oversight allows unauthenticated remote attackers to exploit the vulnerability, facilitating arbitrary command execution on the affected device.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved