CVE Alert: CVE-2025-60341 – n/a – n/a

Risk verdict

Conditional risk: a DoS can be triggered by a crafted SSID input in the device’s wifi settings handler; PoC exists but exploitation state, KEV, SSVC, and EPSS data are not provided, so urgency cannot be fully ranked—elevated if the management interface is reachable from untrusted networks.

Why this matters

DoS on a consumer router can disrupt essential connectivity for homes and small offices, delaying critical communications and business activities. With many devices deployed in civilian networks, repeated attempts could cause widespread service degradation, particularly if automatic reboots occur.

Most likely attack path

Attacker would need access to the device’s administrative interface (local LAN or WAN if remote management is enabled) and supply a crafted SSID value to trigger the overflow. The outcome is a denial of service rather than guaranteed code execution, so initial impact is service disruption with limited lateral movement under typical conditions.

Who is most exposed

Commonly deployed in households and small businesses; exposure is highest when WAN/remote admin access is enabled or firmware is outdated and unpatched, leaving a broad set of devices reachable from the internet or untrusted networks.

Detection ideas

• DoS events: repeated device reboots or unresponsiveness after saving Wi‑Fi settings
• Logs showing wifi stack or kernel stack overflow entries
• Unusual spikes in CPU/memory on the wireless service
• Crashes or dumps during Wi‑Fi configuration changes
• Correlated PoC activity or anomalous admin interface activity

Mitigation and prioritisation

• Apply vendor firmware updates that address the overflow condition; verify patch applicability to the affected version
• If patching is delayed, disable remote administration and restrict admin UI to trusted LAN segments
• Implement network segmentation to limit management access to designated admin hosts
• Monitor for DoS indicators and firmware crash dumps; prepare incident response playbooks
• If exploitation likelihood or exposure (WAN access) increases, escalate the prioritisation accordingly; data on KEV/EPSS/SSVC would refine this.