Linksys E1200 2.0.11.001 HTTP validate_static_route stack-based overflow

Summaryinfo

A vulnerability has been found in Linksys E1200 2.0.11.001 and classified as critical. This issue affects the function validate_static_route of the component HTTP Handler. Performing a manipulation of the argument route_ipaddr_0~3/route_netmask_0~3/route_gateway_0~3 results in stack-based overflow. This vulnerability is identified as CVE-2025-60694. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linksys E1200 2.0.11.001. This affects the function validate_static_route of the component HTTP Handler. The manipulation of the argument route_ipaddr_0~3/route_netmask_0~3/route_gateway_0~3 with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function improperly concatenates user-supplied CGI parameters (route_ipaddr_0~3, route_netmask_0~3, route_gateway_0~3) into fixed-size buffers (v6, v10, v14) without proper bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.

This vulnerability is uniquely identified as CVE-2025-60694 since 09/26/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/14/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2604). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Linksys Router

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• E1200

Version

• 2.0.11.001

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion