{"cvss":6.5,"datePublished":"2025-11-13T16:15:52.720","dateUpdated":"2026-11-05T14:10:00.273","description":"An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the \"imei\" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication.","id":"CVE-2025-60687","raw":{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:lr1200gb_firmware:9.1.0u.6619_b20230130:*:*:*:*:*:*:*","matchCriteriaId":"00F36DE9-D043-4C8B-9EF9-8DA669589E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:lr1200gb:-:*:*:*:*:*:*:*","matchCriteriaId":"8442849E-5B06-41A1-8DA8-827FBD7A34E5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the \"imei\" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication."},{"lang":"es","value":"Una vulnerabilidad de inyección de comandos no autenticada existe en el firmware del router ToToLink LR1200GB V9.1.0u.6619_B20230130 dentro del binario cstecgi.cgi (función sub_41EC68). El binario lee el parámetro ’imei’ de una solicitud web y verifica únicamente que tenga 15 caracteres de longitud. El parámetro es luego insertado directamente en un comando del sistema usando sprintf() y ejecutado con system(). Una entrada IMEI maliciosamente elaborada puede ejecutar comandos arbitrarios en el router sin autenticación."}],"id":"CVE-2025-60687","lastModified":"2026-11-05T14:10:00.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-60687","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-13T17:34:49.982276Z","version":"2.0.3"}}]},"published":"2025-11-13T16:15:52.720","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60687.md"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://www.totolink.net/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]},"severity":"MEDIUM","source":"nvd","title":"An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B2023..."}