CVE-2025-60690: Buffer Overflow
A stack-based buffer overflow exists in the getmergeipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200v2.0.11.001us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching <parameter>0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60690?
CVE-2025-60690 is classified as a high-severity vulnerability due to the potential for remote code execution through a stack-based buffer overflow.
How do I fix CVE-2025-60690?
To mitigate CVE-2025-60690, update your Linksys E1200 v2 router to the latest firmware version provided by Linksys.
What devices are affected by CVE-2025-60690?
CVE-2025-60690 specifically affects the Linksys E1200 v2 routers running Firmware E1200_v2.0.11.001_us.tar.gz.
What is the impact of CVE-2025-60690?
The impact of CVE-2025-60690 includes the possibility of remote attackers executing arbitrary code on the affected router.
Is CVE-2025-60690 easy to exploit?
CVE-2025-60690 is considered relatively easy to exploit due to the lack of bounds checking on user-supplied input.