Command Injection Vulnerability in ToToLink A720R Router Firmware

CVE-2025-60683

What is CVE-2025-60683?

A command injection vulnerability has been identified in the firmware of the ToToLink A720R Router, specifically affecting version V4.1.5cu.614_B20230630. The issue lies within the sysconf binary, particularly in the sub_40BFA4 function responsible for reinitializing network interfaces. The validation of input is insufficient, as it only checks the prefix of interface names. Consequently, an attacker possessing write access to the relevant file could exploit this flaw to inject arbitrary commands, which would then be executed via the system() function without appropriate escaping, posing serious risks to device security.

References