CVE-2025-60683 describes a command injection vulnerability in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630. The vulnerability resides in the sysconf binary, specifically in the sub_40BFA4 function that processes network interface reinitialization commands from the '/var/system/linux_vlan_reinit' file. The function only partially validates interface name prefixes and concatenates input into shell commands executed via system() without proper escaping. This allows an attacker with write access to the file to inject and execute arbitrary commands on the router.

An attacker who can write to the '/var/system/linux_vlan_reinit' file can execute arbitrary commands on the router with the privileges of the sysconf binary. This can lead to partial confidentiality and integrity loss on the device, but does not affect availability. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity.

No patch or official fix is currently available for this vulnerability. Since the vulnerability requires write access to a specific system file, restricting write permissions to '/var/system/linux_vlan_reinit' and limiting access to trusted users can mitigate exploitation risk. Monitor vendor advisories for updates or patches addressing this issue.