Is CVE-2025-60691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60691 being exploited in the wild.

How severe is CVE-2025-60691?

High severity, with a CVSS score of 8.8, published 13 November 2025.

Is there a fix for CVE-2025-60691?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60691 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2025-60691?

Check whether you run Linksys E1200 or Linksys E1200 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60691: Linksys E1200 v2 stack buffer overflow in httpd apply_cgi

CVE-2025-60691 · Severity: high · CVSS 8.8 · Published 2025-11-13

A security vulnerability has been identified in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity in homes and small offices. An attacker can exploit this flaw to take complete control of the router or crash it, potentially leading to a total loss of internet service and the exposure of network traffic. This attack can be carried out remotely without needing a password or any user interaction.

Technologies: Linksys E1200, Linksys E1200 Firmware. Vendors: Linksys.

Quick answers

Is CVE-2025-60691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60691 being exploited in the wild.
How severe is CVE-2025-60691?: High severity, with a CVSS score of 8.8, published 13 November 2025.
Which products and versions are affected?: Linksys E1200 2.0.11.001_us.
Is there a fix for CVE-2025-60691?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60691 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-60691?: Check whether you run Linksys E1200 or Linksys E1200 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the 'httpd' binary of Linksys E1200 v2 routers running firmware version 2.0.11.001_us. The vulnerability is located within the 'apply_cgi' and 'block_cgi' functions, which handle CGI parameters. Specifically, the 'url' parameter is retrieved via 'get_cgi' and passed to 'sprintf' to be copied into stack buffers (v36 and v29) without any bounds checking. Because these destination buffers are incorrectly allocated as single-byte variables, any non-empty input triggers an overflow. An unauthenticated attacker on the adjacent network can exploit this by sending a specially crafted POST request to endpoints like '/cgi-bin/tmBlock.cgi' to overwrite the stack and achieve remote code execution (RCE).

Affected products

Linksys E1200 v2 2.0.11.001_us

Timeline

2025-11-13: disclosed: Initial vulnerability disclosure
2025-11-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.