A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
References
| Link | Resource |
|---|---|
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/1.md | Broken Link |
| https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60702.md | Exploit Third Party Advisory |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
18 Nov 2025, 01:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Totolink a950rg
Totolink Totolink a950rg Firmware |
|
| CPE | cpe:2.3:h:totolink:a950rg:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:a950rg_firmware:5.9c.4592_b20191022:*:*:*:*:*:*:* |
|
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/1.md - Broken Link | |
| References | () https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60702.md - Exploit, Third Party Advisory | |
| References | () https://www.totolink.net/ - Product |
14 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
13 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 20:15
Updated : 2025-11-18 01:49
NVD link : CVE-2025-60702
Mitre link : CVE-2025-60702
CVE.ORG link : CVE-2025-60702
JSON object : View
Products Affected
totolink
- a950rg_firmware
- a950rg
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')