CVE-2025-60335
Published: 22 October 2025
Summary
CVE-2025-60335 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Totolink N600R Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A NULL pointer dereference vulnerability exists in the main function of the TOTOLINK N600R router running firmware version v4.3.0cu.7866_B20220506. The flaw, tracked as CWE-476, is triggered when the device processes a specially crafted HTTP request, resulting in a crash that produces a denial-of-service condition. The issue carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can exploit the weakness by sending a single malicious HTTP request to an exposed management interface. Successful exploitation terminates the affected process, rendering the router unresponsive until it is restarted and thereby disrupting network connectivity for all connected clients.
The associated EPSS score began at a low value, rose to a peak of 0.0266 on 2026-02-23, and has since declined to the current level of 0.0089, indicating a temporary increase in exploitation interest after public disclosure. Public references consist of proof-of-concept material hosted on GitHub; no vendor advisory or patch information is provided in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35585
Vulnerability details
A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL pointer dereference in router's HTTP handler enables exploitation for denial of service via crafted request, directly facilitating T1499.004 (Application or System Exploitation).
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.