Linksys E7350 up to 1.1.00.032 address sub_4045A8 stack-based overflow

Summaryinfo

A vulnerability has been found in Linksys E7350 up to 1.1.00.032 and classified as critical. The impacted element is the function sub_4045A8 of the file /sys/class/net/%s/address. The manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2025-60695. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Linksys E7350 up to 1.1.00.032. It has been rated as critical. This issue affects the function sub_4045A8 of the file /sys/class/net/%s/address. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). The function sub_4045A8 reads up to 256 bytes from /sys/class/net/%s/address into a local buffer and then copies it into caller-provided buffer a1 using strcpy without boundary checks. Since a1 is often allocated with significantly smaller sizes (20-32 bytes), local attackers controlling the contents of /sys/class/net/%s/address can trigger buffer overflows, leading to memory corruption, denial of service, or potential arbitrary code execution.

The identification of this vulnerability is CVE-2025-60695 since 09/26/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/14/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2604). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Linksys Router

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• E7350

Version

• 1.1.00.032

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion