TI-2025-37769 Aliases CVE-2025-60696 GHSA-562c-8635-386g

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of…

HIGH 72CWE-121Published 2025-11-13 · Updated 2026-07-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf("%16s ... %18s ..."), storing results into buffers v6 (12 bytes) and v7 (20 bytes). Since the format specifiers allow up to 16 and 18 bytes respectively, oversized input can overflow the buffers, resulting in stack corruption. Local attackers controlling /proc/net/arp contents can exploit this issue to cause denial of service or potentially execute arbitrary code.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00247 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:linksys:re7000_firmware:2.0.15:::::::*	2.0.15	Vulnerable	Linksys
cpe:2.3:h:linksys:re7000:-:::::::*	not specified by NVD	Running on	Linksys

cpe:2.3:o:linksys:re7000_firmware:2.0.15:*:*:*:*:*:*:* Versions 2.0.15 Vulnerable ·Linksys
cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linksys

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-60696
2026-10-03 Alias added: GHSA-562c-8635-386g

References

Exploit 1

https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-RE700/CVE-2025-60696.md

Other 1

https://www.linksys.com/

TI-2025-08604 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 qosClassifier stack-based overflow CVSS 4.0HIGH 8.7
TI-2025-12917 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow CVSS 4.0HIGH 8.7
TI-2025-12916 Memory corruption in Linksys RE6500 CVSS 4.0HIGH 8.7
TI-2025-12915 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow CVSS 4.0HIGH 8.7
TI-2025-12914 Memory corruption in Linksys RE6500 CVSS 4.0HIGH 8.7
TI-2025-08689 Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 singlePortForwardAdd stack-based overflow CVSS 4.0HIGH 8.7

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences