Security readout for executives and security teams
Plain-English summary
This CVE affects the router web interface in named TOTOLINK LR1200GB and NR1800X firmware builds. An unauthenticated network attacker could send an oversized language value that corrupts memory, potentially causing code execution or service disruption. The bundle does not identify a vendor patch.
Executive priority
Prioritize any affected router reachable from the internet or untrusted networks. Business urgency is moderate overall, but rises where these devices protect sensitive networks and cannot be quickly patched or isolated.
Technical view
The reported flaw is a CWE-121 stack buffer overflow in cstecgi.cgi, function sub_42F32C. The web interface uses sprintf() to build Help URL strings from the lang parameter into fixed-size stack buffers without length validation. CVSS 3.1 is 6.5 with network, low-complexity, no-auth, no-user-interaction attack conditions.
Likely exposure
Exposure is most relevant where affected router management web interfaces are reachable from untrusted networks. The structured affected-product metadata is incomplete, but the description names LR1200GB V9.1.0u.6619_B20230130 and NR1800X V9.1.0u.6681_B20230703.
Exploitation context
The source bundle includes a public technical reference, but CISA KEV is false and no cited source establishes active exploitation in the wild. Treat internet-exposed management interfaces as higher risk because authentication is not required.
Researcher notes
Evidence is limited to the CVE description and linked public reference. The CVE affected-product fields are not populated, so validation should rely on exact model and firmware strings from the description until vendor data is confirmed.
Mitigation direction
- Check TOTOLINK guidance for fixed firmware or replacement advice.
- Update affected devices if vendor-supported firmware is available.
- Block WAN access to router management interfaces.
- Restrict administration to trusted networks or VPN access.
- Replace unsupported affected devices if no fix is available.
Validation and detection
- Inventory TOTOLINK LR1200GB and NR1800X devices and firmware versions.
- Confirm whether management web interfaces are internet-accessible.
- Review vendor pages for advisories or fixed firmware.
- Check edge scans for exposed router administration ports.
- Review device logs for unusual web interface requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-60684 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L3.92.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.totolink.net/CVE reference, mitre
- https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-LR1200GB/CVE-2025-60684.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.