CVE-2025-60691: Buffer Overflow
A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200v2.0.11.001us.tar.gz). The applycgi and blockcgi functions copy user-supplied input from the "url" CGI parameter into stack buffers (v36, v29) using sprintf without bounds checking. Because these buffers are allocated as single-byte variables, any non-empty input will trigger a buffer overflow. Remote attackers can exploit this vulnerability via crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60691?
CVE-2025-60691 has been classified as a critical vulnerability due to its stack-based buffer overflow that can lead to remote code execution.
How do I fix CVE-2025-60691?
To mitigate CVE-2025-60691, users should update their Linksys E1200 v2 routers to the latest firmware version provided by Linksys.
Who is affected by CVE-2025-60691?
CVE-2025-60691 specifically affects Linksys E1200 v2 routers with certain firmware versions, exposing them to potential exploits.
What are the potential impacts of CVE-2025-60691?
Exploiting CVE-2025-60691 may allow attackers to execute arbitrary code, leading to unauthorized access and control over the router.
What functions are involved in CVE-2025-60691?
The apply_cgi and block_cgi functions in the httpd binary are responsible for the stack-based buffer overflow found in CVE-2025-60691.