External risk intelligence

TOTOLINK N600R Firmware Buffer Overflow in UPLOAD_FILENAME Component

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-46060

The affected product is a consumer network router. Such devices are commonly deployed at the network edge to provide internet connectivity, and features like file upload components on router management interfaces are frequently reachable via the local network or, in misconfigured or default states, exposed to the public internet.

Buffer Overflow

Totolink N600r Firmware

4.3.0cu.7866_b2022506

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in TOTOLINK N600R network devices, specifically within a file upload component. This flaw could potentially allow attackers to execute unauthorized code remotely, posing a significant security risk to network infrastructure. The primary concern is to determine if these affected devices are in use within our environment.

Remote attackers can exploit a code execution flaw.
This affects widely deployed consumer network equipment.
Assess if this specific device is in our network.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending a specially crafted request over the network. If the device is exposed to the internet or if the attacker is on the same local network, they could interact with the UPLOAD_FILENAME feature. This interaction could lead to a buffer overflow, potentially allowing the attacker to execute their own code on the device.

No authentication or privileges needed.
Triggered by sending a malicious file name.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in the UPLOAD_FILENAME component of the TOTOLINK N600R could allow an unauthenticated remote attacker to execute arbitrary code. This could occur when the device's web interface is accessible and processes specially crafted upload requests.

System code execution.
Remote code execution over network.
Compromised router functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The TOTOLINK N600R router firmware is affected by a critical buffer overflow vulnerability. This issue likely falls under the purview of network infrastructure or platform teams responsible for managing edge devices, with potential collaboration from security operations for exposure assessment. The immediate priority is to identify all instances of this firmware, confirm their network exposure and business criticality, and then coordinate remediation efforts, potentially involving vendor engagement.

Network or platform teams own remediation.
Verify external reachability and criticality first.
Plan coordinated firmware update or replacement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK N600R?

The TOTOLINK N600R is a consumer-grade wireless network router designed for home or small office connectivity. These devices serve as the gateway between local devices and the internet, handling traffic routing, wireless signals, and network management. Because they act as the network perimeter, they manage the initial traffic processing that this vulnerability exploits.

What does the buffer overflow in CVE-2025-46060 mean?

This vulnerability is classified as CWE-120, which is a classic buffer overflow. In plain terms, the software fails to properly check the amount of data it receives in the UPLOAD_FILENAME component. By sending more data than the system expects, an attacker can overwrite adjacent memory, which can force the device to run unauthorized, malicious commands instead of its normal routing tasks.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted request to the router's file upload feature. It does not require any valid login credentials or prior administrative access to the device. Note that the flaw specifically targets the UPLOAD_FILENAME component; normal network traffic passing through the router without interacting with this specific management interface does not trigger the vulnerability.

Why should I care about this vulnerability?

If you use this hardware, you are at risk because Halo Surface Signal identifies the N600R as a device commonly found at the network edge. If your router's management interface is reachable from the internet, or if an attacker gains access to your local network, they could compromise the device entirely. This allows them to control your network traffic or use your router as a launchpad for further internal attacks.

What should I do if I use this TOTOLINK device?

First, verify if you have the N600R in your environment and check if it is running the affected firmware version. If found, confirm if its management interface is exposed to the internet and restrict access to internal networks only. Consult the manufacturer for available firmware updates to address the overflow. If updates are unavailable, consider replacing the hardware, as edge devices with critical code execution flaws are high-value targets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.