CVE-2025-60693 describes a stack-based buffer overflow in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers with firmware version E1200_v2.0.11.001_us.tar.gz. The function concatenates up to six CGI parameters named <parameter>_0 through <parameter>_5 into a fixed-size buffer without proper bounds checking, appending colon delimiters during concatenation. This lack of bounds validation allows remote attackers to send specially crafted HTTP requests that overflow the buffer, potentially leading to denial of service or arbitrary code execution without requiring authentication.

Successful exploitation can lead to denial of service or remote code execution on affected devices. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the affected device's management interface from untrusted networks to reduce exposure.