A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.
References
| Link | Resource |
|---|---|
| http://totolink.com | Broken Link |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60685.md | Exploit Third Party Advisory |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
17 Nov 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Totolink a720r
Totolink a720r Firmware Totolink |
|
| CPE | cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.614_b20230630:*:*:*:*:*:*:* cpe:2.3:h:totolink:a720r:-:*:*:*:*:*:*:* |
|
| References | () http://totolink.com - Broken Link | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A720R/CVE-2025-60685.md - Exploit, Third Party Advisory | |
| References | () https://www.totolink.net/ - Product |
13 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-121 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.1 |
13 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 16:15
Updated : 2025-11-17 21:50
NVD link : CVE-2025-60685
Mitre link : CVE-2025-60685
CVE.ORG link : CVE-2025-60685
JSON object : View
Products Affected
totolink
- a720r
- a720r_firmware
CWE
CWE-121
Stack-based Buffer Overflow