CVE-2025-60682

Name of the Vulnerable Software and Affected Versions ToToLink A720R Router firmware version 4.1.5cu.614 B20230630

Description A command injection issue exists in the ToToLink A720R Router firmware. The sub 402414 function, responsible for handling cloud update parameters, does not properly sanitize user-supplied data. Specifically, the magicid and url values are directly incorporated into shell commands and executed using the system() function without appropriate escaping. This allows a remote attacker to execute arbitrary commands on the device without authentication.

Recommendations Update to a newer version of the ToToLink A720R Router firmware that addresses this vulnerability.