CVE-2025-60695
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
47/100
Published: 2025-11-13
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
Low
I:
Low
A:
Low
Description
A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). The function sub_4045A8 reads up to 256 bytes from /sys/class/net/%s/address into a local buffer and then copies it into caller-provided buffer a1 using strcpy without boundary checks. Since a1 is often allocated with significantly smaller sizes (20-32 bytes), local attackers controlling the contents of /sys/class/net/%s/address can trigger buffer overflows, leading to memory corruption, denial of service, or potential arbitrary code execution.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| linksys | e7350_firmware | 1.1.00.032 |
References & Advisories (2)
Product
Exploit
Third Party Advisory