Unauthenticated Command Injection Vulnerability in Linksys E1200 Router
CVE-2025-60689

5.4MEDIUM

Key Information:

Vendor

Linksys
Status
E1200 Router
Vendor
CVE Published:
13 November 2025

What is CVE-2025-60689?

An unauthenticated command injection flaw has been identified in the Start_EPI function of the httpd binary present in Linksys E1200 v2 routers. This vulnerability is triggered when user-supplied CGI parameters are inadequately sanitized before being executed, allowing malicious actors to execute arbitrary commands remotely without the need for authentication. This presents a serious risk to the integrity and functionality of the router and the network it manages.

References

http://linksys.com
https://www.linksys.com/
https://github.com/yifan20020708/SGTaint-0-day/blob/main/...

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.