N600r Firmware CVE-2025-46060

This vulnerability represents CRITICAL real-world risk across multiple dimensions: (1) CVSS 9.8 with AV:N (network-exploitable), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction) indicates maximum attack feasibility; (2) The attack surface is the WAN-exposed web interface of a consumer router, making it trivially reachable by any Internet attacker; (3) CWE-120 buffer overflows in firmware are highly reliable to exploit with deterministic code execution; (4) No patching delays or workarounds are feasible for end-users—firmware updates are the only mitigation; (5) Given the commodity nature of the TOTOLINK N600R and presence of known CVE disclosure, exploitation likelihood via POC or automated tools is HIGH. EPSS probability should exceed 85%. This is not a false-alarm high-CVSS issue—it is a genuine critical IoT infrastructure risk affecting potentially thousands of deployed devices. Prioritize immediate patching or device isolation.

An attacker crafts a malicious HTTP POST request with a specially crafted multipart form containing an oversized UPLOAD_FILENAME field (e.g., 2000+ bytes when the buffer is 256 bytes). The request is sent to the router's firmware upload endpoint (e.g., /cgi-bin/upload or similar) without authentication. The vulnerable firmware copies the filename into a fixed-size buffer without validation, causing a stack or heap overflow. The attacker overflows into adjacent memory containing a return address or saved EIP, replacing it with an address pointing to attacker-controlled shellcode in the overflow payload. When the upload function returns, execution jumps to the shellcode, executing arbitrary commands with router root privileges. Result: complete router compromise, enabling data interception, botnet infection, ISP credential theft, or use as a pivot point into the internal network. No POC is explicitly referenced in provided data, but buffer overflow exploitation is deterministic and likely trivial for skilled attackers; public POC release is probable if not already available on exploit databases.