Dashboard / CVE-2025-60684

CVE-2025-60684

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 73/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
totolink lr1200gb_firmware 9.1.0u.6619_b20230130
totolink nr1800x_firmware 9.1.0u.6681_b20230703

References & Advisories (2)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.55%
Raw Score 0.005490
Percentile 46.2%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00549
2026-11-08
0.00549
2026-11-07
0.00549
2026-11-06
0.00549
2026-11-05
0.00549

Intelligence Sources

nvd ref →

External Links