Vulnerability Database

309,130

Total vulnerabilities in the database

CVE-2025-60699

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the global.so binary. The getSaveConfig function retrieves the http_host parameter from user input via websGetVar and copies it into a fixed-size stack buffer (v13) using strcpy() without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.

  • Published: Nov 13, 2025
  • Updated: Nov 19, 2025
  • CVE: CVE-2025-60699
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWEs:

Software From Fixed in
totolink / a950rg_firmware 5.9c.4592_b20191022 5.9c.4592_b20191022.x