CVE-2025-60702: TOTOLINK A950RG Router firmware · Command Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 2.5% chance of exploitation in 30 days – higher than 84% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 13 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Immediate mitigation should focus on restricting access to the router’s web interface by limiting it to trusted management networks or VPNs, and disabling remote management if not required. Network-level protections such as firewall rules to block unauthorized HTTP requests to the router’s management interface can reduce exposure. Monitoring network traffic for unusual or suspicious HTTP requests targeting the router’s web interface parameters can help detect exploitation attempts. Since no official patches are currently available, organizations should engage with TOTOLINK support for firmware updates or advisories. As a longer-term measure, consider replacing vulnerable devices with routers from vendors with stronger security track records and timely patch management. Additionally, implement network segmentation to isolate critical assets from devices with known vulnerabilities and maintain up-to-date inventories of network hardware to identify affected devices quickly.
Description
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.