A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.
References
| Link | Resource |
|---|---|
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/2.md | Broken Link |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60699.md | Exploit Third Party Advisory |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
18 Nov 2025, 01:51
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:totolink:a950rg_firmware:5.9c.4592_b20191022:*:*:*:*:*:*:* cpe:2.3:h:totolink:a950rg:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/2.md - Broken Link | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60699.md - Exploit, Third Party Advisory | |
| References | () https://www.totolink.net/ - Product | |
| First Time |
Totolink a950rg Firmware
Totolink Totolink a950rg |
14 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-121 |
13 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 20:15
Updated : 2025-11-18 01:51
NVD link : CVE-2025-60699
Mitre link : CVE-2025-60699
CVE.ORG link : CVE-2025-60699
JSON object : View
Products Affected
totolink
- a950rg
- a950rg_firmware
CWE
CWE-121
Stack-based Buffer Overflow