CVE-2025-60694
Published: 13 November 2025
Summary
CVE-2025-60694 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Linksys E1200 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A stack-based buffer overflow vulnerability exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers running firmware E1200_v2.0.11.001_us.tar.gz. The flaw stems from unsafe concatenation of unauthenticated CGI parameters (route_ipaddr_0~3, route_netmask_0~3, and route_gateway_0~3) into fixed-size stack buffers without bounds checking, corresponding to CWE-121. The issue received a CVSS 3.1 score of 7.5 with network attack vector and no required privileges or user interaction.
Remote attackers can exploit the vulnerability by sending specially crafted HTTP requests to the router's web interface, enabling arbitrary code execution or denial of service without authentication. The affected component is exposed to the network, making the flaw remotely triggerable against any internet-facing or LAN-accessible E1200 v2 device.
The listed references point to Linksys vendor pages and a GitHub technical write-up but contain no details on patches, firmware updates, or mitigation steps. The EPSS score reached a modest peak of 0.0513 several months after disclosure before receding to its current value of 0.0318, indicating limited sustained exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-175327
Vulnerability details
A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function improperly concatenates user-supplied CGI parameters (route_ipaddr_0~3, route_netmask_0~3, route_gateway_0~3) into fixed-size buffers (v6, v10, v14) without proper bounds checking.…
more
Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of public-facing httpd via buffer overflow enables arbitrary code execution (T1190) or denial of service (T1499.004).
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.