Dashboard / CVE-2025-60688

CVE-2025-60688

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 73/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (setDefResponse function). The binary reads the "IpAddress" parameter from a web request and copies it into a fixed-size stack buffer using strcpy() without any length validation. Maliciously crafted input can overflow the buffer, leading to potential arbitrary code execution or memory corruption, without requiring authentication.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
totolink lr1200gb_firmware 9.1.0u.6619_b20230130
totolink nr1800x_firmware 9.1.0u.6681_b20230703

References & Advisories (2)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.55%
Raw Score 0.005490
Percentile 46.2%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00549
2026-11-08
0.00549
2026-11-07
0.00549
2026-11-06
0.00549
2026-11-05
0.00549

Intelligence Sources

nvd ref →

External Links