PT-2025-46902 · Totolink · Totolink A950Rg Router

Published 2025-11-13 · Updated 2025-11-18 · CVE-2025-60702

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG Router firmware versions V5.9c.4592 B20191022 ALL

Description A command injection issue exists in the TOTOLINK A950RG Router firmware. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and incorporates it into a ping system command executed via CsteSystem() without proper sanitization. An unauthenticated remote attacker can leverage this to execute arbitrary commands on the device by sending crafted HTTP requests to the router's web interface. The vulnerable component is the system.so binary.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the setDiagnosisCfg function. Avoid using the ipDoamin parameter in HTTP requests to the router's web interface until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-15915

CVE-2025-60702

Affected Products

Totolink A950Rg Router

References · 10

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60702.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60702 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60702 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15915 · Security Note
• https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/1.md · Note
• https://t.me/CVEtracker/37280 · Telegram Post
• https://twitter.com/CVEnew/status/1989194847459373367 · Twitter Post
• https://totolink.net · Note
• https://t.me/cveNotify/143128 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989230457074995424 · Twitter Post