An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication.
References
| Link | Resource |
|---|---|
| http://totolink.com | Broken Link |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60687.md | Exploit Third Party Advisory |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
19 Nov 2025, 17:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:totolink:lr1200gb:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:lr1200gb_firmware:9.1.0u.6619_b20230130:*:*:*:*:*:*:* |
|
| First Time |
Totolink lr1200gb
Totolink lr1200gb Firmware Totolink |
|
| References | () http://totolink.com - Broken Link | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60687.md - Exploit, Third Party Advisory | |
| References | () https://www.totolink.net/ - Product |
13 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
13 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 16:15
Updated : 2025-11-19 17:38
NVD link : CVE-2025-60687
Mitre link : CVE-2025-60687
CVE.ORG link : CVE-2025-60687
JSON object : View
Products Affected
totolink
- lr1200gb
- lr1200gb_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')