Buffer overflow in Linksys Re7000
CVE-2025-60696
A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf("%16s ... %18s ..."), storing results into buffers v6 (12 bytes) and v7 (20 bytes). Since the format specifiers allow up to 16 and 18 bytes respectively, oversized input can overflow the buffers, resulting in stack corruption. Local attackers controlling /proc/net/arp contents can exploit this issue to cause denial of service or potentially execute arbitrary code.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (12.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Linksys Re7000
- Linksys Re7000 Firmware — versions 2.0.15
Weakness classification (CWE)
References
- linksys.com (Product)
- www.linksys.com/ (Product)
- github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-RE700/CVE-2025… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-60696?
- CVE-2025-60696 is a high-severity vulnerability in Linksys Re7000, classified under Stack-based Buffer Overflow. CVSS score: 8.4/10. Published 2025-11-13.
- How severe is CVE-2025-60696?
- High severity. CVSS v3 base score is 8.4 out of 10.