Command Injection Vulnerability in ToToLink A720R Router Firmware
CVE-2025-60683

6.5MEDIUM

Key Information:

Vendor

ToToLink
Status
A720R Router
Vendor
CVE Published:
13 November 2025

What is CVE-2025-60683?

A command injection vulnerability has been identified in the firmware of the ToToLink A720R Router, specifically affecting version V4.1.5cu.614_B20230630. The issue lies within the sysconf binary, particularly in the sub_40BFA4 function responsible for reinitializing network interfaces. The validation of input is insufficient, as it only checks the prefix of interface names. Consequently, an attacker possessing write access to the relevant file could exploit this flaw to inject arbitrary commands, which would then be executed via the system() function without appropriate escaping, posing serious risks to device security.

References

http://totolink.com
https://www.totolink.net/
https://github.com/yifan20020708/SGTaint-0-day/blob/main/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.