# CVE-2025-60692: Cisco Linksys E1200 stack overflow in libshared.so

Source: https://junglewise.ai/threats/cve-2025-60692-cisco-linksys-e1200-stack-overflow-in-libshared-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60692 · Severity: high · CVSS 8.4 · Published 2025-11-13

A security vulnerability exists in the firmware of Cisco Linksys E1200 v2 routers, which are commonly used for home and small office networking. The flaw occurs in how the router processes internal network address tables. If an attacker gains local access to the device, they could trigger a system crash or potentially take full control of the router, leading to unauthorized access to network traffic or a complete service outage.

Technologies: [Linksys E1200](https://junglewise.ai/threats/technologies/e1200), [Linksys E1200 Firmware](https://junglewise.ai/threats/technologies/e1200-firmware). Vendors: [Linksys](https://junglewise.ai/threats/vendors/linksys).

## Quick answers

**Is CVE-2025-60692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60692 being exploited in the wild.

**How severe is CVE-2025-60692?** High severity, with a CVSS score of 8.4, published 13 November 2025.

**Which products and versions are affected?** Cisco Linksys Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz.

**Is there a fix for CVE-2025-60692?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60692 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2025-60692?** Check whether you run Linksys E1200 or Linksys E1200 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The functions 'get_mac_from_ip' and 'get_ip_from_mac' utilize the 'sscanf' function with overly permissive '%100s' format specifiers to parse entries from the /proc/net/arp system file into fixed-size stack buffers (v6 and v7 sub-arrays) that are only 50 bytes in size. An attacker with local access or the ability to modify the filesystem (e.g., via mount binding or prior compromise) can provide malformed ARP entries to overflow these buffers. This leads to memory corruption, which can be leveraged for Denial of Service (DoS) or arbitrary code execution. No patch is currently specified in the advisory.

## Affected products

- Cisco Linksys Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz

## Timeline

- 2025-11-13: advisory: Initial NVD publication date

## References

- [https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60692.md](https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60692.md)
- [https://www.linksys.com/](https://www.linksys.com/)

## Related threats

- [Linksys E1200 v2 stack buffer overflow in httpd get_merge_mac](https://junglewise.ai/threats/cve-2025-60693-linksys-e1200-v2-stack-buffer-overflow-in-httpd-get-merge-mac)
- [Linksys E1200 v2 stack overflow in validate_static_route](https://junglewise.ai/threats/cve-2025-60694-linksys-e1200-v2-stack-overflow-in-validate-static-route)
- [Linksys E1200 v2 stack buffer overflow in httpd apply_cgi](https://junglewise.ai/threats/cve-2025-60691-linksys-e1200-v2-stack-buffer-overflow-in-httpd-apply-cgi)
- [Linksys E1200 v2 stack overflow in httpd get_merge_ipaddr](https://junglewise.ai/threats/cve-2025-60690-linksys-e1200-v2-stack-overflow-in-httpd-get-merge-ipaddr)