Stack-Based Buffer Overflow in Linksys E1200 v2 Router

CVE-2025-60693

What is CVE-2025-60693?

A stack-based buffer overflow vulnerability has been identified in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers. This flaw arises when the function concatenates up to six user-supplied CGI parameters into a fixed-size buffer without adequate bounds checking, thus appending colon delimiters. Attackers can remotely exploit this vulnerability through specially crafted HTTP requests, leading to arbitrary code execution or potential denial of service. It poses a significant risk as it can be exploited without authentication, allowing unauthorized users to wreak havoc on affected devices.

References