CVE-2025-60702

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-607037.8Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.CVE-2025-607047.5Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.CVE-2025-607057.8Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2025-607065.5Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2025-607077.8Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.CVE-2025-607086.5Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.CVE-2025-607097.8Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2025-60715.3Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to dCVE-2025-607107.8Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate prCVE-2025-607116.3Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-607137.8Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locallCVE-2025-607147.8Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.
CVE-2025-60702: Medium severity, CVSS 6.5 | Vulnix