CVE-2025-60335
📋 TL;DR
A NULL pointer dereference vulnerability in TOTOLINK N600R routers allows attackers to crash the device via specially crafted HTTP requests, causing a Denial of Service. This affects users of TOTOLINK N600R routers running vulnerable firmware versions. The device becomes unresponsive until manually rebooted.
💻 Affected Systems
- TOTOLINK N600R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent DoS rendering the router completely inoperable, requiring physical reset and disrupting all network connectivity for connected devices.
Likely Case
Temporary service disruption where the router crashes and requires reboot, causing network downtime for minutes to hours.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Proof of concept available on GitHub showing how to trigger the NULL pointer dereference via HTTP request with specific CONTENT-LENGTH header.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware for N600R. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
HTTP Request Filtering
allBlock or filter HTTP requests with abnormal CONTENT-LENGTH headers at network perimeter
Access Restriction
linuxRestrict HTTP/HTTPS access to router management interface to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN with strict access controls
- Implement network monitoring for abnormal HTTP traffic patterns targeting router IP
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly v4.3.0cu.7866_B20220506, device is vulnerable.Check Version:
Check router web interface at http://[router-ip]/ or use nmap scan: nmap -sV -p 80,443 [router-ip]Verify Fix Applied:
After firmware update, verify version has changed from v4.3.0cu.7866_B20220506 to newer version.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- HTTP requests with abnormal CONTENT-LENGTH values
- Failed HTTP connections to router management interface
Network Indicators:
- HTTP requests to router IP with CONTENT-LENGTH header manipulation
- Sudden loss of connectivity to router
SIEM Query:
source="router_logs" AND (event="crash" OR event="reboot") OR http.request.uri contains "/" AND http.headers.content_length > [threshold]