Stack-based Buffer Overflow in Linksys RE7000 Router

CVE-2025-60696

What is CVE-2025-60696?

A stack-based buffer overflow exists in the makeRequest.cgi binary of Linksys RE7000 routers, specifically within the arplookup function. This function improperly handles input when parsing the ARP table from /proc/net/arp, allowing up to 16 and 18 bytes to be stored into buffers that only allocate 12 and 20 bytes respectively. An attacker with local access can exploit this flaw by manipulating the contents of /proc/net/arp, leading to potential denial of service or the execution of arbitrary code on the affected routers.

References