CVE-2025-60696

HighCVSS 8.4

Published: 13/11/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf, allowing oversized input to overflow buffers (12 and 20 bytes). Local attackers controlling /proc/net/arp contents can cause stack corruption, leading to denial of service or potential arbitrary code execution.

Risk Assessment

The risk for the organization includes local privilege escalation or router instability, potentially resulting in network disruption or device compromise by an attacker.

Recommendation

Immediately update the Linksys RE7000 router firmware to the latest version if a patch is available. If no update exists, restrict local access to the device and monitor system logs for suspicious entries in /proc/net/arp.

Other vulnerabilities in Linksys RE7000

CVE-2026-86299Critical
A vulnerability was detected in Linksys RE7000 2.0.15. It affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest in the PingTest Handler component. Manipulation of the arguments pingTestIp/pingTestPktSize/pingTestTimes results in OS command injection. The attack can be launched remotely. The exploit is now public and may be used.

Original NVD description (English source)

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf("%16s ... %18s ..."), storing results into buffers v6 (12 bytes) and v7 (20 bytes). Since the format specifiers allow up to 16 and 18 bytes respectively, oversized input can overflow the buffers, resulting in stack corruption. Local attackers controlling /proc/net/arp contents can exploit this issue to cause denial of service or potentially execute arbitrary code.