Executive brief
A security vulnerability has been identified in the Linksys E1200 v2 router, a device used to provide wireless internet connectivity in homes and small offices. An attacker can exploit this flaw by sending specially crafted web requests to the router's management interface. If successful, this could allow the attacker to crash the device, causing a complete loss of internet connectivity, or potentially take control of the router to execute unauthorized commands.
Technical details
A stack-based buffer overflow exists in the 'validate_static_route' function within the 'httpd' binary of Linksys E1200 v2 routers (firmware v2.0.11.001). The vulnerability is caused by the improper use of 'strcat' when concatenating user-supplied CGI parameters (route_ipaddr_0~3, route_netmask_0~3, and route_gateway_0~3) into fixed-size 20-byte buffers (v6, v10, v14) without bounds checking. A remote, unauthenticated attacker can exploit this by sending a POST request to /cgi-bin/validate_static_route containing oversized strings for these parameters. This can lead to memory corruption, resulting in a denial of service (device crash) or potential remote code execution.
Affected products
- Linksys E1200 v2 Router Firmware E1200_v2.0.11.001_us.tar.gz
Timeline
- 2025-11-13: advisory: NVD Published Date
- 2025-11-13: disclosed: Initial disclosure of the vulnerability details and PoC on GitHub