Buffer overflow in Linksys Re7000
CVE-2025-60696
A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf("%16s ... %18s ..."), storing results into buffers v6 (12 bytes) and v7 (20 bytes). Since the format specifiers allow up to 16 and 18 bytes respectively, oversized input can overflow the buffers, resulting in stack corruption. Local attackers controlling /proc/net/arp contents can exploit this issue to cause denial of service or potentially execute arbitrary code.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (13.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linksys Re7000
- Linksys Re7000_firmware — versions 2.0.15
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-60696?
- CVE-2025-60696 is a high-severity vulnerability in Linksys Re7000, classified under Stack-based Buffer Overflow. CVSS score: 8.4/10. Published 2025-11-13.
- How severe is CVE-2025-60696?
- High severity. CVSS v3 base score is 8.4 out of 10.