CVE-2025-60702
published 2025-11-13CVE-2025-60702: A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg`…
PriorityP180medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.54%
84.9th percentile
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a950rg_firmware | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vulncheck6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-chxj-6g8r-wh5q: A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5
ghsa_unreviewed·2025-11-13
CVE-2025-60702 [MEDIUM] CWE-77 GHSA-chxj-6g8r-wh5q: A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
VulnCheck
TOTOLINK a950rg_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2025·CVSS 6.5
CVE-2025-60702 [MEDIUM] TOTOLINK a950rg_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
TOTOLINK a950rg_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Affected: TOTOLINK a950rg_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation o
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-13
Published
Exploited in the wild