CVE-2025-60702: totolink a950rg Command Injection

Vulnerability summary

CVE-2025-60702 is a medium (CVSS 6.5) Command Injection vulnerability in totolink a950rg. EPSS estimates a 2.54% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-11-2025
   PublishedVulnerability first disclosed.
2. 14-11-2025
   Last modifiedVulnerability information updated.

Description

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.