CVE-2025-60689: Command Injection
An unauthenticated command injection vulnerability exists in the StartEPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200v2.0.11.001us.tar.gz). The vulnerability occurs because user-supplied CGI parameters (wlant, wlssid, wlrate, ttcpnum, ttcpip, ttcpsize) are concatenated into system command strings without proper sanitization and executed via wlexeccmd. Successful exploitation allows remote attackers to execute arbitrary commands on the device without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60689?
The severity of CVE-2025-60689 is classified as high due to the potential for unauthenticated command injection.
How do I fix CVE-2025-60689?
To fix CVE-2025-60689, it is recommended to upgrade the Linksys E1200 router firmware to the latest version that addresses this vulnerability.
What can attackers achieve by exploiting CVE-2025-60689?
By exploiting CVE-2025-60689, attackers can execute arbitrary commands on the router without authentication.
Which devices are affected by CVE-2025-60689?
CVE-2025-60689 affects Linksys E1200 v2 routers running the specified vulnerable firmware version.
Is authentication required to exploit CVE-2025-60689?
No, authentication is not required to exploit CVE-2025-60689, making it particularly dangerous.