CVE-2025-60684

6.5 mediumEPSS 0.5%

Medium (6.5) in totolink. EPSS 0.5% chance of exploitation in the next 30 days.

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-121
Published: 2025-11-13
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Affected

totolink:lr1200gb_firmware
totolink:nr1800x_firmware

References

Check your stack JSON