Dashboard / CVE-2025-60685

CVE-2025-60685

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 45/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
totolink a720r_firmware 4.1.5cu.614_b20230630

References & Advisories (2)

Bug Bounty Relevance

45 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.1 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.24%
Raw Score 0.002380
Percentile 15.0%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00238
2026-11-08
0.00238
2026-11-07
0.00238
2026-11-06
0.00238
2026-11-05
0.00238

Intelligence Sources

nvd ref →

External Links