Is CVE-2025-60694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60694 being exploited in the wild.

How severe is CVE-2025-60694?

High severity, with a CVSS score of 7.5, published 13 November 2025.

Which products and versions are affected?

Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz.

Is there a fix for CVE-2025-60694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60694 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-60694?

Check whether you run Linksys E1200 or Linksys E1200 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60694: Linksys E1200 v2 stack overflow in validate_static_route

CVE-2025-60694 · Severity: high · CVSS 7.5 · Published 2025-11-13

A security vulnerability has been identified in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity in homes and small offices. An attacker can exploit this flaw by sending specially crafted web requests to the router's management interface. If successful, this could allow the attacker to crash the device, causing a complete loss of internet connectivity, or potentially take control of the router to execute unauthorized commands.

Technologies: Linksys E1200, Linksys E1200 Firmware. Vendors: Linksys.

Quick answers

Is CVE-2025-60694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60694 being exploited in the wild.
How severe is CVE-2025-60694?: High severity, with a CVSS score of 7.5, published 13 November 2025.
Which products and versions are affected?: Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz.
Is there a fix for CVE-2025-60694?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60694 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-60694?: Check whether you run Linksys E1200 or Linksys E1200 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the 'validate_static_route' function within the 'httpd' binary of Linksys E1200 v2 routers (firmware v2.0.11.001). The vulnerability is caused by the improper use of 'strcat' when concatenating user-supplied CGI parameters (route_ipaddr_0~3, route_netmask_0~3, and route_gateway_0~3) into fixed-size 20-byte buffers (v6, v10, v14) without bounds checking. A remote, unauthenticated attacker can exploit this by sending a POST request to /cgi-bin/validate_static_route containing oversized strings for these parameters. This can lead to memory corruption, resulting in a denial of service (device crash) or potential remote code execution.

Affected products

Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz

Timeline

2025-11-13: advisory: NVD Published Date
2025-11-13: disclosed: Initial disclosure of the vulnerability details and PoC on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.