CVE-2025-60690

published 2025-11-13

CVE-2025-60690: A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz)…

Priority P2 69 high 8.8 CVSS 3.1

AV A AC L PR N UI N S U C H I H A H

EXPLOIT

A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching _0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
linksys	e1200_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /apply.cgi↗

port 8888↗

other Authorization: Basic YWRtaW46YWRtaW4=↗

bytes↗

action=Apply&lan_netmask=&lan_ipaddr=4&lan_ipaddr_0=x&lan_ipaddr_1=x&lan_ipaddr_2=x&lan_ipaddr_3=<74xA>\xa0\x1e\xd6\x2a<24xA>\x44\xa0\xd6\x2a<72xA>\xfc\xd8\xd4\x2a<28xA>

• → Detect POST requests to /apply.cgi with oversized lan_ipaddr_3 parameter values (>74 bytes) — indicative of stack buffer overflow exploitation in get_merge_ipaddr. ↗
• → Alert on HTTP POST to /apply.cgi containing the pattern lan_ipaddr_0=x&lan_ipaddr_1=x&lan_ipaddr_2=x&lan_ipaddr_3= followed by a long payload — this matches the exploit's exact parameter structure. ↗
• → Monitor for outbound telnet connections from the router to attacker-controlled IPs on port 8888, which is the hardcoded reverse shell port used by the exploit. ↗
• → Detect creation of /tmp/f as a named pipe (mkfifo) on embedded Linux devices — a classic reverse shell staging indicator used in this exploit. ↗
• → Alert on 'killall httpd' followed by 'httpd' restart commands in CGI-executed contexts — the exploit kills and restarts httpd as part of payload delivery. ↗
• → The exploit is unauthenticated per the CVE description despite the exploit-db title saying 'Authenticated'; detect exploitation attempts regardless of Authorization header presence. ↗
• → Look for the Base64 credential string 'YWRtaW46YWRtaW4=' (admin:admin) in Authorization headers targeting Linksys E1200 devices on port 80. ↗

• · The CVE describes the vulnerability as unauthenticated, but the Exploit-DB entry titles it 'Authenticated Stack Buffer Overflow'. The exploit code includes a hardcoded admin:admin Basic Auth header. Detection rules should cover both authenticated and unauthenticated variants. ↗
• · The ROP gadget addresses in the exploit payload (\xa0\x1e\xd6\x2a, \x44\xa0\xd6\x2a, \xfc\xd8\xd4\x2a) are specific to firmware E1200_v2.0.11.001_us / 2.0.04 and may differ across firmware versions, limiting byte-signature detection to those exact builds. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121