A command injection vulnerability (CVE-2025-60702) exists in the TOTOLINK A950RG Router firmware version V5.9c.4592_B20191022_ALL. The flaw is in the system.so binary's setDiagnosisCfg function, which unsafely concatenates user input into a ping command, allowing unauthenticated remote attackers to execute arbitrary commands via crafted HTTP requests to the router's web interface.