Buffer Overflow Vulnerability in ToToLink Routers

CVE-2025-60688

What is CVE-2025-60688?

A stack buffer overflow vulnerability has been identified in the ToToLink LR1200GB and NR1800X router firmware. This issue arises within the cstecgi.cgi binary, specifically in the setDefResponse function, which improperly handles the 'IpAddress' parameter from web requests. The function utilizes strcpy() to copy this parameter into a fixed-size stack buffer without validating the length, allowing malicious actors to exploit this flaw. Such an exploit could lead to arbitrary code execution or memory corruption, with no authentication required, making affected devices particularly vulnerable.

References