TOTOLINK A950RG 5.9c.4592_B20191022_ALL HTTP global.so strcpy http_host stack-based overflow

Summaryinfo

A vulnerability classified as critical has been found in TOTOLINK A950RG 5.9c.4592_B20191022_ALL. This impacts the function strcpy of the file global.so of the component HTTP Handler. The manipulation of the argument http_host leads to stack-based overflow. This vulnerability is traded as CVE-2025-60699. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in TOTOLINK A950RG 5.9c.4592_B20191022_ALL and classified as very critical. This issue affects the function strcpy of the file global.so of the component HTTP Handler. The manipulation of the argument http_host with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.

The identification of this vulnerability is CVE-2025-60699 since 09/26/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/14/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• TOTOLINK

Name

• A950RG

Version

• 5.9c.4592_B20191022_ALL

License

• commercial

Website

• Vendor: https://www.totolink.net/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion