E1200 Firmware
CVE-2025-60690
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects significant impact potential with the attack vector being adjacent network (AV:A), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), resulting in high confidentiality, integrity, and availability impacts. The EPSS score of 0.57% places this in the 68th percentile, indicating moderate real-world exploitation likelihood compared to other CVEs. The availability of public proof-of-concept exploits significantly elevates the practical risk, as it lowers the barrier for exploitation. While not currently listed in CISA KEV, the combination of no authentication requirement, public exploits, and the widespread deployment of these consumer routers makes this a priority for organizations using affected devices. The adjacent network attack vector requirement provides some mitigation, as attackers must be on the same network segment as the vulnerable device. |
| Exploit ScenarioDerived | An attacker on the same network segment as the vulnerable Linksys E1200 v2 router sends specially crafted HTTP requests to the device's web interface, exploiting the buffer overflow in the get_merge_ipaddr function by providing oversized parameter values in CGI requests. The attacker achieves remote code execution on the router without needing any credentials, potentially gaining full control of the device and network traffic. Public proof-of-concept code is available on GitHub, making exploitation straightforward for even moderately skilled attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A stack-based buffer overflow vulnerability exists in the Linksys E1200 v2 router firmware that allows remote attackers to execute arbitrary code or cause denial of service without authentication. The vulnerability occurs in the httpd binary's get_merge_ipaddr function, which improperly concatenates user-supplied CGI parameters into a fixed-size buffer without bounds checking. With publicly available proof-of-concept exploits and an EPSS score of 0.57% (68th percentile), this represents a moderate exploitation risk for affected devices.
RemediationAI
No official patch is currently available from Linksys for this vulnerability. As an immediate mitigation, restrict access to the router's web interface by implementing strict network segmentation and access control lists that limit connections to trusted IP addresses only. Consider replacing affected E1200 v2 routers with newer models that receive regular security updates, as the E1200 v2 appears to be end-of-life. If replacement is not immediately possible, disable remote management features and ensure the router is only accessible from the internal network. Monitor the Linksys security page for any future updates, though given the age of this model, a patch is unlikely.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Linksys E1200 v2 routers running firmware version 2.0.11.001 (CPE: cpe:2.3:o:linksys:e1200_firmware:2.0.11.001:*:*:*:*:*:*:*). This is a classic stack-based buffer overflow (CWE-121) where the get_merge_ipaddr function in the httpd binary concatenates up to four user-supplied CGI parameters matching the pattern <parameter>_0 through <parameter>_3 into a fixed-size buffer without performing proper bounds checking. The httpd binary handles web interface requests on the router, making this vulnerability accessible via standard HTTP requests to the device's management interface.
Know when E1200 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching <parameter>_0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
Executive ViewAI
Organizations using the get_merge_ipaddr function of the httpd binary on Linksys E1200 face significant risk from CVE-2025-60690, a stack-based buffer overflow vulnerability rated CVSS 8.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in E1200 Firmware
View allLinksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name. Rated critical severity (CVSS 9.8), thi
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version
A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.
A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 route
A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmwa
An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version
A stack-based buffer overflow exists in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers (Firm
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200