Vulnerabilidades de Linksys
CVEs publicadas que afetam produtos de Linksys: 32 registro(s), com severidade, exploração e correções.
MR9600 8MX4200 6E1200 Firmware 6RE7000 5Re7000 Firmware 5E1700 5Re6300 Firmware 4RE9000 4RE6350 4RE6300 4RE6250 4RE6500 4Re9000 Firmware 4Re6350 Firmware 4Re6250 Firmware 4Re6500 Firmware 4E5600 Firmware 3Mr9600 Firmware 3Wap11 1E9450-sg Firmware 1Linksys E9450-SG 1E7350 Firmware 1Mx4200 Firmware 1Befsr81 1Befsr41 1Befn2ps4 1
CVE-2025-60694
Alta · 7.5
CWE-121 13/11/2025
Stack-based Buffer Overflow em Linksys E1200 Firmware
A stack-based buffer overflow exists in the validate_static_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function improperly concatenates user-supplied CGI parameters (route_ipaddr_0~3, route_netmask_0~3, route_gateway_0~3) into fixed-size buffers (v6, v10, v14) without proper bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
CVE-2025-60692
Alta · 8.4
CWE-121 13/11/2025
Stack-based Buffer Overflow em Linksys E1200 Firmware
A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The functions get_mac_from_ip and get_ip_from_mac use sscanf with overly permissive "%100s" format specifiers to parse entries from /proc/net/arp into fixed-size buffers (v6: 50 bytes, v7 sub-arrays: 50 bytes). This allows local attackers controlling the contents of /proc/net/arp to overflow stack buffers, leading to memory corruption, denial of service, or potential arbitrary code execution.
CVE-2025-60691
Alta · 8.8
CWE-121 13/11/2025
Stack-based Buffer Overflow em Linksys E1200 Firmware
A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The apply_cgi and block_cgi functions copy user-supplied input from the "url" CGI parameter into stack buffers (v36, v29) using sprintf without bounds checking. Because these buffers are allocated as single-byte variables, any non-empty input will trigger a buffer overflow. Remote attackers can exploit this vulnerability via crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
CVE-2025-60690
Alta · 8.8
Exploit público CWE-121 13/11/2025
Stack-based Buffer Overflow em Linksys E1200 Firmware
A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching <parameter>_0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.
CVE-2025-60689
Média · 5.4
Exploit público CWE-77 13/11/2025
Command Injection em Linksys E1200 Firmware
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The vulnerability occurs because user-supplied CGI parameters (wl_ant, wl_ssid, wl_rate, ttcp_num, ttcp_ip, ttcp_size) are concatenated into system command strings without proper sanitization and executed via wl_exec_cmd. Successful exploitation allows remote attackers to execute arbitrary commands on the device without authentication.
CVE-2002-0109
Média · 6.4
25/03/2002
Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products…
Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community string "public," which causes the router to change its configuration and send SNMP trap information back to the system that initiated the query.
CVE-2001-0514
Alta · 7.5
21/07/2001
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear…
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network.