CVE-2025-60685 describes a stack-based buffer overflow in the sysconf binary of ToToLink A720R Router firmware version 4.1.5cu.614_B20230630. The vulnerability occurs because the binary reads the /proc/stat file using fgets() into a local buffer and then parses the line with sscanf() into a single-byte variable using the %s format specifier. Maliciously crafted content in /proc/stat can overflow the buffer and overwrite adjacent stack memory, potentially allowing arbitrary code execution by an attacker who has filesystem write privileges on the device.

Successful exploitation can lead to arbitrary code execution on the affected router device. The vulnerability requires the attacker to have filesystem write privileges, which limits the attack vector to scenarios where such access is already obtained or possible. The CVSS score of 5.1 reflects a medium severity impact with low confidentiality impact, no integrity impact, and low availability impact.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict filesystem write access to trusted users only to mitigate exploitation risk.