Is CVE-2025-60696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60696 being exploited in the wild.

How severe is CVE-2025-60696?

High severity, with a CVSS score of 8.4, published 13 November 2025.

Which products and versions are affected?

Linksys Re7000 FW_v2.0.15_211230_1012.

Is there a fix for CVE-2025-60696?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-60696 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-60696?

Check whether you run Linksys Re7000 or Linksys Re7000 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60696: Linksys RE7000 stack overflow in makeRequest.cgi arplookup

CVE-2025-60696 · Severity: high · CVSS 8.4 · Published 2025-11-13

A security vulnerability exists in the Linksys RE7000 range extender, a device used to expand home or office Wi-Fi coverage. The flaw is located in a component responsible for processing network requests and managing local network address tables. If exploited, a local attacker could cause the device to crash or potentially take full control of the system, leading to a complete loss of service and unauthorized access to the device's operations.

Technologies: Linksys Re7000, Linksys Re7000 Firmware. Vendors: Linksys.

Quick answers

Is CVE-2025-60696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60696 being exploited in the wild.
How severe is CVE-2025-60696?: High severity, with a CVSS score of 8.4, published 13 November 2025.
Which products and versions are affected?: Linksys Re7000 FW_v2.0.15_211230_1012.
Is there a fix for CVE-2025-60696?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60696 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-60696?: Check whether you run Linksys Re7000 or Linksys Re7000 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the 'arplookup' function within the 'makeRequest.cgi' binary of Linksys RE7000 routers running firmware version FW_v2.0.15_211230_1012. The vulnerability is caused by the unsafe use of 'sscanf' when parsing lines from '/proc/net/arp'. Specifically, the function uses format specifiers '%16s' and '%18s' to populate buffers 'v6' (12 bytes) and 'v7' (20 bytes) respectively. Because the format specifiers allow more data than the destination buffers can hold, an attacker who can control the contents of the ARP table (e.g., via local filesystem write permissions or mount binding) can trigger a buffer overflow. This leads to stack corruption, which can be leveraged for denial of service or arbitrary code execution.

Affected products

Linksys RE7000 FW_v2.0.15_211230_1012

Timeline

2025-11-13: advisory: Initial disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.