CVE-2025-60686 is a local stack-based buffer overflow vulnerability in ToToLink router binaries infostat.cgi and cstecgi.cgi. Both binaries parse the /proc/net/arp file using sscanf() with "%s" format specifiers into fixed-size stack buffers without validating input length. One function writes user-controlled data into a single-byte buffer, and the other writes into adjacent small arrays without bounds checking. An attacker with local access who can control /proc/net/arp contents may trigger memory corruption, leading to denial of service or potential arbitrary code execution. The affected devices include ToToLink A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703 firmware versions. There is no indication of known exploits in the wild or available patches as of the published date.

Successful exploitation can cause memory corruption resulting in denial of service or potentially arbitrary code execution on affected ToToLink routers. The vulnerability requires local access to manipulate /proc/net/arp contents. Confidentiality and integrity impacts are low, but availability can be disrupted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patches or official fixes are indicated, users should restrict local access to the affected devices and monitor vendor communications for updates. No vendor advisory or patch links are currently available.