Executive brief
A security vulnerability exists in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity in homes and small offices. An attacker can exploit this flaw by sending a specially crafted web request to the router's management interface. If successful, this could allow the attacker to crash the device or potentially take control of it, leading to a loss of internet access or unauthorized access to the network.
Technical details
A stack-based buffer overflow exists in the 'get_merge_mac' function within the 'httpd' binary of Linksys E1200 v2 routers. The vulnerability is caused by the unsafe use of 'strcat' when concatenating up to six user-supplied CGI parameters (formatted as <parameter>_0 through <parameter>_5) into a fixed-size stack buffer (a2) without bounds checking. An unauthenticated remote attacker can exploit this by sending a POST request with overly long strings in these parameters, leading to memory corruption. This can result in arbitrary code execution or a denial of service (DoS) by crashing the web service. The issue was identified in firmware version E1200_v2.0.11.001_us.tar.gz.
Affected products
- Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz
Timeline
- 2025-11-13: advisory: NVD Published Date
- 2025-11-13: disclosed: Initial disclosure by MITRE/CISA-ADP