CVE-2025-60691 is a stack-based buffer overflow vulnerability in the httpd binary of Linksys E1200 v2 routers with firmware E1200_v2.0.11.001_us. The apply_cgi and block_cgi functions copy user-supplied input from the "url" CGI parameter into stack buffers using sprintf without bounds checking. Since these buffers are single-byte variables, any non-empty input causes a buffer overflow. This can be exploited remotely via crafted HTTP requests without requiring authentication, potentially leading to arbitrary code execution or denial of service.

Successful exploitation allows remote attackers to execute arbitrary code or cause denial of service on affected Linksys E1200 v2 routers. The vulnerability requires no authentication and can be triggered remotely via HTTP requests, posing a high risk to device integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interface from untrusted networks to reduce exposure.