CVE-2025-60685 Details
Description
A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.
A stack buffer overflow vulnerability has been identified in the ToToLink A720R Router firmware version 4.1.5cu.614_B20230630. The issue resides within the sysconf binary, specifically in the sub_401EE0 function. The vulnerability arises because the binary reads the /proc/stat file using fgets() into a local buffer, and then parses the line with sscanf() into a single-byte variable using the %s format specifier. This allows maliciously crafted /proc/stat content to overwrite adjacent stack memory, potentially enabling an attacker with filesystem write privileges to execute arbitrary code on the device.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60685.md | [email protected] | ExploitThird Party Advisory |
| https://www.totolink.net/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| totolink a720r firmware | 4.1.5cu.614_b20230630 |
CPE
Remediation
| |
| totolink a720r | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 17, 2025 | Reanalysis | [email protected] |
| Nov 17, 2025 | Initial Analysis | [email protected] |
| Nov 13, 2025 | CVE Modified | CISA-ADP |
| Nov 13, 2025 | New CVE Received | [email protected] |