Skip to content
Fencer Vulns
high 8.8

CVE-2025-60690 json

A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.…

published 2025-11-13 11 mo ago modified 2026-11-05 3 d ago also EUVD-2025-175339

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.2%
EPSS 4.2% chance of exploitation in 30 days, percentile 90%
public exploits
1
Exploit-DB

Summary

A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching <parameter>_0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.

Timeline

  1. Published
  2. First public exploit (EDB-52548)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction

4.15% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52548 Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE) hardware, 2026-05-04
  • github.com https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60690.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.