Local Stack-Based Buffer Overflow in ToToLink Routers

CVE-2025-60686

What is CVE-2025-60686?

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers. The vulnerability arises from the way these programs handle the contents of /proc/net/arp, utilizing sscanf() with '%s' format specifiers that write to fixed-size stack buffers without adequate length validation. This oversight allows an attacker with control over /proc/net/arp to overwrite buffers, resulting in memory corruption that can lead to a denial of service or potential arbitrary code execution.

References