TOTOLINK N600R
CVE-2025-60335
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP management interface
-
ExploitSend crafted HTTP request
-
ExecutionTrigger NULL pointer dereference
-
ImpactCrash service, cause DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the TOTOLINK N600R (firmware 4.3.0cu.7866_B20220506) HTTP service; per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and needs no user interaction, triggered by a single crafted HTTP request. The practical limiting factor is reachability of the web management interface: on a typical SOHO deployment this is LAN-side only, so unauthenticated remote exploitation across the internet depends on WAN-side/remote administration being enabled. Impact is confined to availability (service crash/DoS) - there is no confidentiality or integrity effect. The precise request element that triggers the NULL dereference is not detailed in the available sources beyond the crafted-HTTP-request description. |
| Impact | Signals are mostly consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger with impact limited strictly to availability (C:N/I:N/A:H), which is coherent with a NULL pointer dereference (CWE-476) causing a crash rather than code execution. EPSS is 2.13% (82nd percentile) - modest in absolute terms but above median, and the vuln.today decision label is 'this_week' rather than act_now/emergency, so this is a near-term patch priority, not a drop-everything event. It is NOT on CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists but is not verified as working exploit code, so exploit maturity is uncertain. The main caveat: AV:N assumes the vulnerable HTTP service is reachable over the network, which for a SOHO router is usually LAN-side unless remote/WAN management is enabled - this materially limits real-world exposure and should be weighed against the raw 7.5 score. |
| Exploit ScenarioDerived | An attacker able to reach the N600R's HTTP management service sends a single crafted HTTP request that drives the main function into a NULL pointer dereference, crashing the process and denying service to legitimate users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required and the request is low-complexity. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Denial of service in TOTOLINK N600R routers running firmware 4.3.0cu.7866_B20220506 allows unauthenticated network attackers to crash the device's HTTP service with a single crafted request that dereferences a NULL pointer in the main function. CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no confidentiality or integrity effect, and EPSS places near-term exploitation likelihood at about 2.13% (82nd percentile). A public PoC reference exists (a GitHub BinaryAudit write-up); it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
RemediationAI
No vendor-released patch was identified at time of analysis, and neither of the supplied references documents a fixed firmware version, so the exact remediated build cannot be cited. Until TOTOLINK publishes updated firmware for the N600R, the effective control is reducing reachability of the vulnerable HTTP service: disable WAN-side/remote administration so the web management interface is not reachable from the internet, and restrict LAN access to the management UI to trusted hosts (for example via an upstream firewall rule or management-VLAN segregation) - the trade-off is that legitimate remote administration is lost and must be performed from inside the network or over a VPN. Because the impact is a crash of the web service, operators should also be prepared to power-cycle or reboot an affected unit to restore management access after an attack. Monitor the VulDB advisory (https://vuldb.com/vuln/329428) and TOTOLINK's firmware download channel for a patched release, and re-check exposure of the management interface on any N600R still in service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the firmware of the TOTOLINK N600R, a small-office/home-office wireless router; the CPE cpe:2.3:o:totolink:n600r_firmware:4.3.0cu.7866_b20220506 identifies the single firmware build in scope. The root cause class is CWE-476, NULL pointer dereference: code in the program's main function does not validate a value derived from the incoming HTTP request before using it as a pointer, so the process dereferences NULL and terminates, taking the web management service down. The trigger is exercised over the network against the device's HTTP service, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required; the practical gating factor is reachability of the management interface, which on typical SOHO deployments is LAN-side only unless WAN-side or remote administration has been enabled. The precise request element that causes the dereference is not described in the available sources; the linked Proof-of-Concept reference is titled CONTENT_LENGTH_MAX, which suggests a Content-Length header value is involved, but this is an inference from the reference title and is not confirmed by the supplied evidence.
Know when N600r Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated low-complexity crafted HTTP request to a network-reachable service (AV:N/AC:L/PR:N/UI:N) causing only a crash, so C:N/I:N and A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
TOTOLINK N600R routers, often deployed as small business or remote office gateways, are exposed to a high-severity, unauthenticated denial-of-service vulnerability (CVE-2025-60335) that can crash the device's HTTP management service with a single crafted request. This puts internet-facing devices at risk of service disruption, potentially cutting off network access and management for branch locations. Leadership should prioritize inventorying and securing these devices, as exploitation is currently not confirmed but a public reference PoC exists, and no vendor patch is available.
Restrict management access to trusted networks, disable HTTP service if unused, monitor for malicious traffic, and replace devices if unsupported.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in N600r Firmware
View allTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter
Critical remote code execution vulnerability in TOTOLINK N600R router firmware v4.3.0cu.7866_B2022506, exploitable throu
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. Rated critical s
Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the s
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the url parameter in the function
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the File parameter in the function
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the funct
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the funct
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the func
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress parameter in the fu
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the funct
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the funct
Exploit-DB