CVE-2025-46060

The vulnerability exists in the UPLOAD_FILENAME component of the TOTOLINK N600R firmware. An attacker sends a crafted request containing an excessively long value in the UPLOAD_FILENAME field, which causes a buffer overflow in accordance with CWE-120. Lack of proper validation of input data length allows overwriting memory areas, which consequently leads to gaining control over the program execution flow.

An attacker can remotely execute arbitrary code on the device (RCE) without any authentication, gaining full control over the router — including access to sensitive data, ability to modify network configuration, and potential use of the device as a launching point for further attacks.

Patches available from the manufacturer should be applied according to references. Until an update is applied, it is recommended to isolate the device from untrusted networks, block external access to the management interface, and monitor network traffic directed to the device.

TOTOLINK N600R in firmware version 4.3.0cu.7866_B2022506