Dashboard / CVE-2025-60691

CVE-2025-60691

HIGH
MEDIUM Priority: 0.07 BB Relevance: 63/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The apply_cgi and block_cgi functions copy user-supplied input from the "url" CGI parameter into stack buffers (v36, v29) using sprintf without bounds checking. Because these buffers are allocated as single-byte variables, any non-empty input will trigger a buffer overflow. Remote attackers can exploit this vulnerability via crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
linksys e1200_firmware 2.0.11.001

References & Advisories (2)

Bug Bounty Relevance

63 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.76%
Raw Score 0.007590
Percentile 55.5%
Date 2026-11-09

EPSS Trend

2026-11-09
0.00759
2026-11-08
0.00759
2026-11-07
0.00759
2026-11-06
0.00759
2026-11-05
0.00759

Intelligence Sources

nvd ref →

External Links