Executive brief
A security vulnerability has been identified in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity for homes and small offices. An attacker can exploit this flaw by sending a specially crafted web request to the router's management interface. If successful, this could allow the attacker to crash the device or take complete control of it, potentially leading to the interception of network traffic or unauthorized access to the local network.
Technical details
A stack-based buffer overflow exists in the 'get_merge_ipaddr' function within the 'httpd' binary of Linksys E1200 v2 routers running firmware version 2.0.11.001_us. The vulnerability is caused by the unsafe use of 'strcat' when concatenating four user-supplied CGI parameters (formatted as <parameter>_0 through <parameter>_3) into a fixed-size stack buffer without performing bounds checking. An unauthenticated attacker on the adjacent network can exploit this by sending a POST request with overly long parameter values, leading to memory corruption. This can result in arbitrary code execution or a denial-of-service (DoS) condition. While a Proof of Concept (PoC) exists, there is currently no official patch mentioned in the advisory.
Affected products
- Linksys E1200 v2 2.0.11.001_us
Timeline
- 2025-11-13: advisory: Initial disclosure of the vulnerability.