CVE-2025-60336
Published: 22 October 2025
Summary
CVE-2025-60336 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Totolink N600R Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-60336 is a NULL pointer dereference vulnerability, tracked under CWE-476, that resides in the sub_41773C function of the TOTOLINK N600R router running firmware version 4.3.0cu.7866_B20220506. The flaw can be triggered by a specially crafted HTTP request and produces a denial-of-service condition, reflected in its CVSS 3.1 base score of 7.5 with a network attack vector and high availability impact.
An unauthenticated remote attacker can send the malicious request directly to the device over the network, causing the affected function to dereference a NULL pointer and crash the service without any user interaction or credentials. Successful exploitation results only in loss of availability; no confidentiality or integrity impact is indicated.
The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.0461, indicating that exploitation interest increased after public disclosure. A single public reference provides a proof-of-concept but contains no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35618
Vulnerability details
A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL pointer dereference in router firmware enables denial of service via crafted HTTP request, matching application exploitation for endpoint DoS.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.