CVE-2025-60686
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-19

Assigner: MITRE

Description
A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation. Specifically, one function writes user-controlled data into a single-byte buffer, and the other into adjacent small arrays without bounds checking. An attacker who controls the contents of /proc/net/arp can trigger memory corruption, leading to denial of service or potential arbitrary code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-13
Last Modified
2025-11-19
Generated
2026-06-16
AI Q&A
2025-11-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-60686
EUVD
EUVD-2025-175300
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
totolink a720r_firmware 4.1.5cu.614_b20230630
totolink a720r *
totolink lr1200gb_firmware 9.1.0u.6619_b20230130
totolink lr1200gb *
totolink nr1800x_firmware 9.1.0u.6681_b20230703
totolink nr1800x *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a local stack-based buffer overflow in two binaries (infostat.cgi and cstecgi.cgi) of certain ToToLink routers. These programs improperly parse the /proc/net/arp file using sscanf() with %s format specifiers into fixed-size stack buffers without checking the length of the input. One function writes user-controlled data into a single-byte buffer, and another writes into adjacent small arrays without bounds checking. This can cause memory corruption.

Impact Analysis

An attacker who can control the contents of /proc/net/arp on the affected router can exploit this vulnerability to cause memory corruption. This can lead to denial of service (crashing the device) or potentially allow the attacker to execute arbitrary code on the device.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-60686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart