CVE-2025-60696 is a stack-based buffer overflow vulnerability identified in the makeRequest.cgi binary of Linksys RE7000 routers, specifically firmware version FW_v2.0.15_211230_1012. The vulnerability stems from the arplookup function, which parses lines from the /proc/net/arp file using the sscanf function with format specifiers "%16s ... %18s ...". These specifiers allow reading up to 16 and 18 bytes respectively, but the destination buffers v6 and v7 are only 12 and 20 bytes in size. This mismatch permits oversized input to overflow the buffer v6, leading to stack corruption. An attacker with local control over the /proc/net/arp contents can exploit this flaw to cause a denial of service by crashing the device or potentially execute arbitrary code, compromising confidentiality, integrity, and availability. The attack requires local access but no privileges or user interaction, increasing its risk in environments where local access is possible. The vulnerability is classified under CWE-121 (stack-based buffer overflow) and has a CVSS v3.1 score of 8.4, indicating high severity. No patches are currently available, and no known exploits have been reported in the wild. The flaw highlights the risks of improper input validation and unsafe parsing in embedded network device firmware.

For European organizations, the impact of CVE-2025-60696 can be significant, particularly for those relying on Linksys RE7000 routers in their network infrastructure. Exploitation can lead to denial of service, disrupting network connectivity and business operations. More critically, the potential for arbitrary code execution could allow attackers to gain control over affected routers, enabling interception or manipulation of network traffic, lateral movement within internal networks, and persistent compromise. This risk is heightened in environments with shared or less restricted local access, such as enterprise offices, managed service provider networks, or multi-tenant facilities. The confidentiality, integrity, and availability of sensitive data and services could be compromised. Given the high CVSS score and the absence of required privileges or user interaction, the vulnerability poses a credible threat to network security and operational continuity. European critical infrastructure sectors, including finance, telecommunications, and government agencies using these devices, may face elevated risks.

1. Immediately restrict local access to affected Linksys RE7000 routers to trusted personnel only, minimizing the risk of local exploitation. 2. Monitor router logs and network behavior for unusual activity indicative of exploitation attempts, such as crashes or unexpected reboots. 3. Disable or restrict access to the makeRequest.cgi interface if possible, or isolate the device from untrusted networks. 4. Implement network segmentation to limit exposure of vulnerable devices to potentially malicious insiders or compromised hosts. 5. Engage with Linksys or authorized vendors to obtain firmware updates or patches addressing this vulnerability as soon as they become available. 6. Until patches are released, consider replacing vulnerable devices in high-risk environments with alternative hardware not affected by this issue. 7. Conduct regular security audits and vulnerability assessments focusing on embedded network devices to detect similar issues proactively. 8. Educate network administrators about the risks of local access exploitation and enforce strict access control policies.