{"cvss":6.5,"datePublished":"2026-09-01T00:00:00Z","dateUpdated":"2026-09-01T00:00:00Z","description":"A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.","dueDate":"","id":"CVE-2025-60702","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"a950rg_firmware","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"MEDIUM","source":"vulncheck_kev","title":"TOTOLINK a950rg_firmware Improper Neutralization of Special Elements used in a Command","vendor":"TOTOLINK"}