16
CVEs
0
Critical
12
High
0
KEV
15
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
12
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (30)
Re6500 Firmware
50
Re7000 Firmware
49
Re6300 Firmware
48
Re9000 Firmware
47
Re6250 Firmware
47
Re6350 Firmware
47
E5600 Firmware
14
E1200 Firmware
10
E8450 Firmware
10
E7350 Firmware
8
E1700 Firmware
5
E2500 Firmware
5
Ea6500
5
Ea6500 Firmware
5
Wrt54Gl Firmware
4
Ea4500 Firmware
3
E2000 Firmware
3
Ea6700 Firmware
2
Wrt1900Acs Firmware
2
Ea6400
2
Ea6900
2
E4200V2 Firmware
2
Ea3500
2
Ea6700
2
Ea6400 Firmware
2
Mr9600 Firmware
2
Ea6300 Firmware
2
Ea2700 Firmware
2
Ea4500
2
Ea6200 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86299 | OS command injection in Linksys RE7000 firmware 2.0.15 allows authenticated low-privilege attackers to execute arbitrary commands on the device by manipulating the pingTestIp, pingTestPktSize, or pingTestTimes parameters of the PingTest CGI handler. The /cgi-bin/json.cgi?PingTest endpoint passes these parameters unsanitized to underlying shell commands, resulting in full device compromise and potential impact to adjacent network infrastructure. A public proof-of-concept exploit is available on GitHub, substantially lowering the exploitation barrier. | HIGH | 8.6 | 2.0% | 65 |
PoC
No patch
|
| CVE-2025-60691 | A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.8% | 65 |
PoC
No patch
|
| CVE-2025-60690 | A stack-based buffer overflow vulnerability exists in the Linksys E1200 v2 router firmware that allows remote attackers to execute arbitrary code or cause denial of service without authentication. The vulnerability occurs in the httpd binary's get_merge_ipaddr function, which improperly concatenates user-supplied CGI parameters into a fixed-size buffer without bounds checking. With publicly available proof-of-concept exploits and an EPSS score of 0.57% (68th percentile), this represents a moderate exploitation risk for affected devices. | HIGH | 8.8 | 0.6% | 65 |
PoC
No patch
|
| CVE-2025-14133 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of the file mod_form.so. Performing manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-14134 | A vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RE2000v2Repeater_get_wireless_clientlist_setClientsName of the file mod_form.so. Executing manipulation of the argument clientsname_0 can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-14135 | A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-14136 | A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-60694 | A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 5.1% | 63 |
PoC
No patch
|
| CVE-2025-60692 | A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.4 | 0.0% | 62 |
PoC
No patch
|
| CVE-2025-60696 | A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.4 | 0.0% | 62 |
PoC
No patch
|
| CVE-2026-4558 | OS command injection in Linksys MR9600 mesh router firmware 2.0.6.206937 allows authenticated remote attackers to execute arbitrary system commands with router privileges via crafted Smart Connect configuration parameters. The vulnerability exists in the SmartConnect.lua file's smartConnectConfigure function, which fails to sanitize user input in configApSsid, configApPassphrase, srpLogin, and srpPassword arguments before passing them to system commands. Publicly available exploit code exists (GitHub POC), but EPSS indicates low (0.15%) exploitation probability and CISA has not listed this in KEV, suggesting limited real-world targeting. Vendor (Linksys) did not respond to researcher disclosure. | HIGH | 7.4 | 0.2% | 57 |
PoC
No patch
|
| CVE-2025-60693 | A stack-based buffer overflow exists in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 2.8% | 55 |
PoC
No patch
|
| CVE-2026-25603 | Path traversal in Linksys MR9600 and MX4200 firmware allows attackers with physical access to mount arbitrary USB drive partitions into the file system, potentially enabling root-level code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected versions include MR9600 1.0.4.205530 and MX4200 1.0.13.210200. | MEDIUM | 6.6 | 0.0% | 53 |
PoC
No patch
|
| CVE-2025-60695 | A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.9 | 0.0% | 50 |
PoC
No patch
|
| CVE-2025-60689 | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated medium severity (CVSS 5.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.4 | 0.2% | 47 |
PoC
No patch
|