PT-2025-46857 · Linksys · Linksys E1200 V2

Published 2025-10-09 · Updated 2025-11-13 · CVE-2025-60689

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Linksys E1200 v2 routers version prior to 2.0.11.001 us

Description A command injection issue exists in the Start EPI function of the httpd binary. The issue is due to insufficient input validation of CGI parameters (wl ant, wl ssid, wl rate, ttcp num, ttcp ip, ttcp size) before they are used to construct and execute system commands via the wl exec cmd function. This allows a remote attacker to execute arbitrary commands on the device without authentication.

Recommendations Update to a version newer than 2.0.11.001 us.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14946

CVE-2025-60689

Affected Products

Linksys E1200 V2

References · 6

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60689.md · Exploit
• https://bdu.fstec.ru/vul/2025-14946 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60689 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60689 · Vendor Advisory
• http://linksys.com · Note
• https://linksys.com · Note