Executive brief
A security vulnerability exists in the firmware of Cisco Linksys E1200 v2 routers, which are commonly used for home and small office networking. The flaw occurs in how the router processes internal network address tables. If an attacker gains local access to the device, they could trigger a system crash or potentially take full control of the router, leading to unauthorized access to network traffic or a complete service outage.
Technical details
A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The functions 'get_mac_from_ip' and 'get_ip_from_mac' utilize the 'sscanf' function with overly permissive '%100s' format specifiers to parse entries from the /proc/net/arp system file into fixed-size stack buffers (v6 and v7 sub-arrays) that are only 50 bytes in size. An attacker with local access or the ability to modify the filesystem (e.g., via mount binding or prior compromise) can provide malformed ARP entries to overflow these buffers. This leads to memory corruption, which can be leveraged for Denial of Service (DoS) or arbitrary code execution. No patch is currently specified in the advisory.
Affected products
- Cisco Linksys Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz
Timeline
- 2025-11-13: advisory: Initial NVD publication date