Executive brief
A security vulnerability has been identified in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity in homes and small offices. An attacker can exploit this flaw to take complete control of the router or crash it, potentially leading to a total loss of internet service and the exposure of network traffic. This attack can be carried out remotely without needing a password or any user interaction.
Technical details
A stack-based buffer overflow exists in the 'httpd' binary of Linksys E1200 v2 routers running firmware version 2.0.11.001_us. The vulnerability is located within the 'apply_cgi' and 'block_cgi' functions, which handle CGI parameters. Specifically, the 'url' parameter is retrieved via 'get_cgi' and passed to 'sprintf' to be copied into stack buffers (v36 and v29) without any bounds checking. Because these destination buffers are incorrectly allocated as single-byte variables, any non-empty input triggers an overflow. An unauthenticated attacker on the adjacent network can exploit this by sending a specially crafted POST request to endpoints like '/cgi-bin/tmBlock.cgi' to overwrite the stack and achieve remote code execution (RCE).
Affected products
- Linksys E1200 v2 2.0.11.001_us
Timeline
- 2025-11-13: disclosed: Initial vulnerability disclosure
- 2025-11-13: advisory: NVD publication date