---METADATA---
VENDOR: Linksys
PRODUCT: MR9600
AFFECTED_VERSIONS: 2.0.6.206937
CONFIDENCE: high
MISSING: patch
CREDITS: wuuu (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359544","name":"VDB-359544 | Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359544/cti","name":"VDB-359544 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797086","name":"Submit #797086 | Linksys MR9600 Firmware 2.0.6.206937 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/utmost3/cve/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Linksys MR9600 JNAP Action Handler allows authenticated remote attackers to execute arbitrary OS commands via the pin argument in BTRequestGetSmartConnectStatus.

Executive Summary:
A critical OS command injection vulnerability in Linksys MR9600 firmware allows authenticated attackers to execute arbitrary system commands, posing a risk of total device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6992

Affected Software: Linksys MR9600

Affected Versions: 2.0.6.206937

Vulnerability: This vulnerability resides in the BTRequestGetSmartConnectStatus function within the /etc/init.d/run_central2.sh script. It is triggered by improper input validation of the pin argument, allowing an authenticated remote attacker to perform OS command injection.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system of the router. This level of access typically results in complete device control, potentially allowing for network interception, traffic redirection, or the use of the device as a pivot point into the internal network. With a CVSS score of 7.2, the impact is considered High, reflecting the potential for total system compromise and loss of confidentiality, integrity, and availability of the gateway device.

Remediation Plan

Immediate Action: As there is no official patch currently available, users should restrict administrative access to the router management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous activity, specifically looking for unexpected command executions or requests directed at the JNAP interface that contain shell metacharacters.

Compensating Controls: Implement a strict firewall policy that limits access to the router's web management interface to a dedicated, secure management VLAN or specific administrator workstations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the JNAP Action Handler.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of command injection on network infrastructure, this vulnerability represents a significant risk. Administrators are strongly urged to monitor vendor communications for a firmware update and apply it immediately upon release. Until a fix is provided, reduce the attack surface by ensuring the management interface is not exposed to the public internet or untrusted network segments.

---METADATA---
VENDOR: Linksys
PRODUCT: MR9600
AFFECTED_VERSIONS: Linksys MR9600: 2.0.6.206937
CONFIDENCE: high
MISSING: patch
CREDITS: wuuu (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352385","name":"VDB-352385 | Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352385","name":"VDB-352385 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.775036","name":"Submit #775036 | Linksys MR9600 firmware 2.0.6.206937 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/utmost3/cve/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:42.587Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Linksys MR9600 smartConnectConfigure function allows remote, authenticated attackers to execute arbitrary OS commands via malicious input parameters.

Executive Summary:
A critical OS command injection vulnerability in the Linksys MR9600 router allows remote attackers to execute arbitrary system commands, posing a severe risk of complete device compromise.

Vulnerability Details

CVE-ID: CVE-2026-4558

Affected Software: Linksys MR9600

Affected Versions: Linksys MR9600: 2.0.6.206937

Vulnerability: The vulnerability resides in the smartConnectConfigure function within the SmartConnect.lua file. By injecting malicious payloads into the configApSsid, configApPassphrase, srpLogin, or srpPassword arguments, an authenticated attacker can achieve OS command injection.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the affected router with elevated privileges. This could lead to full device takeover, unauthorized network access, interception of sensitive traffic, or the redirection of user traffic to malicious infrastructure. Given the CVSS score of 8.8, this flaw represents a significant threat to internal network integrity and confidentiality.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor; users should restrict administrative access to the router to trusted internal interfaces only and disable remote management features immediately.

Proactive Monitoring: Security teams should monitor network traffic for unusual outbound connections initiated by the router and review administrative access logs for suspicious input patterns in configuration requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect traffic destined for the router management interface, specifically looking for shell metacharacters in configuration parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the vulnerability researcher at GitHub.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in a core configuration function.

Analyst Recommendation

This vulnerability presents a high risk to network infrastructure due to the potential for full system compromise. Because the vendor has not yet responded or provided a patch, it is imperative to isolate the management interface of all affected Linksys MR9600 devices from the public internet and limit access to highly restricted administrative segments until an official firmware update is released.

---METADATA---
VENDOR: Linksys
PRODUCT: E1700
AFFECTED_VERSIONS: Linksys E1700: 1.0.0.4.003
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321544","name":"VDB-321544 | Linksys E1700 QoSSetup stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321544","name":"VDB-321544 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634826","name":"Submit #634826 | Linksys E1700 E1700(1.0.0.4.003) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.942Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys E1700 QoSSetup function allows remote attackers to crash the system or execute arbitrary code via the ack_policy parameter.

Executive Summary:
A critical stack-based buffer overflow in the Linksys E1700 router poses a severe risk of remote code execution and persistent service disruption.

Vulnerability Details

CVE-ID: CVE-2025-9527

Affected Software: Linksys E1700

Affected Versions: Linksys E1700: 1.0.0.4.003

Vulnerability: The vulnerability exists in the QoSSetup function of the /goform/QoSSetup endpoint, where the ack_policy argument is copied into a stack buffer without proper length validation. An authenticated attacker can trigger this memory corruption to overwrite the function return address and achieve remote code execution.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for system compromise. Successful exploitation results in complete loss of router availability and the ability for unauthorized actors to execute arbitrary code within the device environment. This poses a significant threat to network integrity, potentially allowing lateral movement into internal segments or the interception of sensitive traffic.

Remediation Plan

Immediate Action: As the vendor has not provided a patch for this specific firmware version, users should restrict administrative access to the router and disable the QoS feature if it is not required for network operations.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at /goform/QoSSetup and review system logs for recurring service crashes or unexpected reboots.

Compensating Controls: Implement an access control list (ACL) to restrict management interface access to trusted internal IP addresses only, and deploy a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious payloads targeting the ack_policy parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's technical write-up provided in the references.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the input parameter.

Analyst Recommendation

Given the lack of a vendor-supplied security update, this vulnerability presents a persistent risk to the affected hardware. Administrators are urged to isolate the management interface from the public internet immediately and monitor for signs of exploitation. If the device cannot be secured via configuration changes, consider retiring the affected hardware in favor of supported alternatives.

---METADATA---
VENDOR: Linksys
PRODUCT: E1700
AFFECTED_VERSIONS: 1.0.0.4.003
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321543","name":"VDB-321543 | Linksys E1700 setSysAdm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321543","name":"VDB-321543 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634825","name":"Submit #634825 | Linksys E1700 E1700(1.0.0.4.003) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_59/59.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_59/59.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.942Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the Linksys E1700 router allows authenticated remote attackers to crash the device or potentially execute arbitrary code via the rm_port argument.

Executive Summary:
A high-severity stack-based buffer overflow in Linksys E1700 routers allows authenticated remote attackers to compromise device stability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-9526

Affected Software: Linksys E1700

Affected Versions: 1.0.0.4.003

Vulnerability: The vulnerability exists within the setSysAdm function of the /goform/setSysAdm endpoint, where the rm_port parameter is processed without adequate length validation. This flaw allows an authenticated user to trigger a stack-based buffer overflow, potentially leading to remote code execution or a persistent denial-of-service condition.

Business Impact

Successful exploitation of this vulnerability can lead to a complete loss of availability for the affected networking hardware, disrupting critical business communications and connectivity. Furthermore, the capacity for arbitrary code execution grants an attacker the ability to pivot into the internal network, potentially leading to unauthorized access to sensitive data or further exploitation of downstream systems. Given the CVSS score of 8.8, this vulnerability represents a significant risk to network integrity.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the web management interface to trusted internal IP addresses only. Disable remote management features entirely until a firmware update is provided by the manufacturer.

Proactive Monitoring: Monitor system logs for repeated crashes or unusual POST requests directed at the /goform/setSysAdm endpoint. Alert on unauthorized attempts to access administrative management pages.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-based Intrusion Prevention System (IPS) to inspect and block excessively long strings within the rm_port parameter of HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up by the researcher.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the target binary.

Analyst Recommendation

Given the severity of this remote code execution vulnerability and the lack of a vendor-supplied patch, immediate mitigation is required to prevent compromise. Network administrators should prioritize isolating affected Linksys E1700 units from external exposure and strictly enforce administrative authentication controls. Continue to monitor official vendor channels for firmware release notifications to permanently address this memory corruption flaw.

---METADATA---
VENDOR: Linksys
PRODUCT: E1700
AFFECTED_VERSIONS: 1.0.0.4.003
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321542","name":"VDB-321542 | Linksys E1700 setWan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321542","name":"VDB-321542 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634824","name":"Submit #634824 | Linksys E1700 E1700(1.0.0.4.003) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_58/58.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_58/58.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.942Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys E1700 router allows authenticated attackers to crash the system or potentially execute arbitrary code via the setWan function.

Executive Summary:
A stack-based buffer overflow vulnerability in the Linksys E1700 router could allow an authenticated attacker to cause a denial of service or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-9525

Affected Software: Linksys E1700

Affected Versions: 1.0.0.4.003

Vulnerability: The vulnerability exists in the setWan function within the /goform/setWan endpoint, where insufficient input validation of the DeviceName and lanIp arguments leads to a stack-based buffer overflow. This flaw requires the attacker to have authenticated access to the device to trigger the malicious payload.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the router, resulting in a denial of service for all dependent network traffic. Furthermore, the ability to overwrite the function return address presents a high risk of arbitrary code execution, potentially granting an attacker full control over the networking device. With a CVSS score of 8.8, this vulnerability represents a significant threat to internal infrastructure integrity and availability.

Remediation Plan

Immediate Action: As there is currently no official patch from the vendor, restrict administrative access to the router to trusted management interfaces only and disable remote management features where possible.

Proactive Monitoring: Monitor device logs for anomalous POST requests directed at the /goform/setWan endpoint and track unexpected device reboots which may indicate crash attempts.

Compensating Controls: Implement strict network access control lists (ACLs) to limit which internal hosts can reach the router management interface, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the referenced research write-up on GitHub.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of bounds checking on user-supplied parameters in a critical administrative function.

Analyst Recommendation

Given the confirmed existence of proof of concept code and the potential for remote code execution, this vulnerability poses a severe risk. Organizations utilizing the Linksys E1700 should prioritize isolating these devices from untrusted network segments until the vendor provides a firmware update. Administrators must maintain heightened vigilance regarding administrative session activity until a permanent fix is verified and applied.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321398","name":"VDB-321398 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 singlePortForwardAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321398","name":"VDB-321398 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634823","name":"Submit #634823 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.950Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in Linksys range extenders allows authenticated remote attackers to execute arbitrary code or crash the device via the singlePortForwardAdd function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extender models poses a severe risk of remote code execution and persistent service disruption.

Vulnerability Details

CVE-ID: CVE-2025-9483

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists within the singlePortForwardAdd function of the /goform/singlePortForwardAdd endpoint. By sending a specially crafted HTTP POST request with excessively long input parameters (ruleName, schedule, or inboundFilter), an authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution.

Business Impact

The exploitation of this vulnerability allows an attacker to gain control over network infrastructure, leading to unauthorized access, potential lateral movement within the local network, and total loss of device availability. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could be leveraged to compromise organizational network integrity.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately isolate these devices from untrusted networks and restrict administrative access to authorized management segments only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the /goform/singlePortForwardAdd endpoint and review system logs for recurring crashes or unexpected service restarts.

Compensating Controls: Implement strict firewall rules to block unauthorized access to the management interface of these devices, effectively limiting the attack surface to trusted internal users.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of August 27, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on critical form parameters.

Analyst Recommendation

Due to the lack of an available vendor patch, the risk of remote code execution remains significant. Organizations should prioritize restricting access to the management interface of affected Linksys devices and monitor for firmware updates from the vendor to remediate this memory corruption flaw as soon as a fix is released.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321397","name":"VDB-321397 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portRangeForwardAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321397","name":"VDB-321397 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634820","name":"Submit #634820 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.950Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Linksys range extenders allows remote authenticated attackers to crash the device or execute arbitrary code via the portRangeForwardAdd function.

Executive Summary:
Multiple Linksys range extenders are vulnerable to a critical stack-based buffer overflow that could allow remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-9482

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the portRangeForwardAdd function within the /goform/portRangeForwardAdd endpoint. An attacker with low-level privileges can supply oversized inputs to parameters including ruleName, schedule, inboundFilter, TCPPorts, or UDPPorts to overwrite the return address on the stack.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with system-level privileges or cause a persistent denial-of-service by crashing the router. Given the CVSS score of 8.8, this poses a severe risk to network integrity and confidentiality. Compromise of network infrastructure devices can facilitate lateral movement, traffic interception, and total loss of administrative control over the local network segment.

Remediation Plan

Immediate Action: As there is currently no official patch from the vendor, users should restrict administrative access to these devices to trusted management IP addresses only and disable remote management features.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at the /goform/portRangeForwardAdd endpoint and watch for frequent device reboots or service outages that may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) capable of inspecting HTTP POST traffic to drop requests containing abnormally long strings in the specified parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is publicly available via a researcher write-up on GitHub.

Analyst Notes: As of August 27, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameters.

Analyst Recommendation

Given the absence of a vendor-provided patch and the availability of a functional proof-of-concept, this vulnerability represents a significant risk. Administrators should immediately isolate these devices from external access and implement strict firewall rules to limit interaction with the administrative web interface until official firmware updates are released.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: Bond_yes (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321396","name":"VDB-321396 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setIpv6 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321396","name":"VDB-321396 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634819","name":"Submit #634819 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.950Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys range extender setIpv6 function allows remote authenticated attackers to execute arbitrary code via the tunrd_Prefix parameter.

Executive Summary:
Multiple Linksys range extenders are vulnerable to a critical buffer overflow that could allow remote code execution by an authenticated attacker.

Vulnerability Details

CVE-ID: CVE-2025-9481

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the setIpv6 function within the /goform/setIpv6 endpoint. By sending a crafted POST request with an excessively long tunrd_Prefix parameter, an authenticated attacker can trigger a buffer overflow, leading to memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows a remote attacker to gain control over the affected network device. This could lead to a complete compromise of the device, enabling the attacker to intercept network traffic, pivot into the local network, or cause persistent denial of service. With a CVSS score of 8.8, this represents a high-severity risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch available; administrators should restrict access to the management interface to trusted IP addresses only and disable administrative access from the WAN side immediately.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /goform/setIpv6 endpoint, particularly those containing abnormally long string arguments.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long inputs targeting the tunrd_Prefix parameter in administrative forms.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub write-up referenced in the CVE record.

Analyst Notes: As of August 27, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to the security of the affected network environment. Because no vendor patch has been released, organizations must prioritize network-level segmentation and restrict administrative access to mitigate the threat until an official firmware update is made available.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: RE6250 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001); RE6300 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001); RE6350 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001); RE6500 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001); RE7000 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001); RE9000 (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001)
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321226","name":"VDB-321226 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaProfile stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321226","name":"VDB-321226 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631538","name":"Submit #631538 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote, authenticated attackers to execute arbitrary code via the addStaProfile function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in several Linksys range extender models permits remote code execution by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-9393

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: See the metadata block for specific firmware versions across the listed models.

Vulnerability: The vulnerability exists within the addStaProfile function of the /goform/addStaProfile endpoint. By submitting excessively long values to parameters such as profile_name or Ssid, an authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution.

Business Impact

Successful exploitation of this flaw allows a remote attacker to gain control over the affected network device. This poses a severe risk to network integrity, as an attacker could intercept traffic, pivot into internal network segments, or permanently disable the device, resulting in significant service disruption and potential data compromise. Given the CVSS score of 8.8, this vulnerability represents a high-risk entry point for further malicious activity within the affected environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, restrict access to the administrative interface of the affected devices to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/addStaProfile endpoint. Review device logs for repeated crashes or unexpected reboots that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to inspect and block malformed HTTP requests containing excessively long strings directed at the vulnerable management form.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of August 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it stems from a lack of input validation on multiple parameters, allowing for direct memory corruption.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to organizational infrastructure. Administrators should prioritize the isolation of these devices from untrusted network segments until the vendor provides a firmware update. Continuous monitoring of management interfaces is essential to detect and prevent unauthorized exploitation attempts.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321225","name":"VDB-321225 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 qosClassifier stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321225","name":"VDB-321225 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631537","name":"Submit #631537 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_32/32.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_32/32.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the qosClassifier function of various Linksys range extenders allows remote attackers to execute arbitrary code via specially crafted POST requests.

Executive Summary:
Multiple Linksys range extenders are vulnerable to a remote stack-based buffer overflow, which could allow an authenticated attacker to execute arbitrary code on the device.

Vulnerability Details

CVE-ID: CVE-2025-9392

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) caused by the lack of boundary checking on multiple input parameters, including dir and sFromPort, within the qosClassifier function. The vulnerability is reachable via the /goform/qosClassifier endpoint and requires the attacker to be authenticated to the device.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected range extender. Given the CVSS score of 8.8, this poses a severe risk to network integrity, as compromised range extenders can serve as a persistent foothold for lateral movement into the internal network or interception of traffic.

Remediation Plan

Immediate Action: Monitor for official firmware updates from Linksys and apply them immediately upon release. As the vendor has not yet provided a patch, restrict administrative access to the device management interface to trusted internal IP addresses only.

Proactive Monitoring: Review web access logs for unusual POST requests directed to the /goform/qosClassifier endpoint, specifically those containing excessively long parameter strings.

Compensating Controls: Deploy a Web Application Firewall or network-level intrusion detection system to block malformed HTTP requests targeting the vulnerable parameters. Ensure that the device management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept demonstrating the crash is available via the researcher's published technical write-up on GitHub.

Analyst Notes: As of August 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct memory corruption path identified in the qosClassifier function.

Analyst Recommendation

The severity of this flaw, combined with the availability of a public proof-of-concept, necessitates immediate defensive action. Administrators should ensure that range extender management interfaces are isolated from external access and prioritize the application of vendor firmware updates as soon as they become available.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321066","name":"VDB-321066 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321066","name":"VDB-321066 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631535","name":"Submit #631535 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_31/31.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_31/31.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in multiple Linksys range extenders allows authenticated remote attackers to execute arbitrary code via the portTriggerManageRule function.

Executive Summary:
Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability in the portTriggerManageRule function that could allow for remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-9363

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability is a stack-based buffer overflow occurring within the /goform/portTriggerManageRule endpoint. An attacker with low-level access can supply overly long strings to the triggerRuleName or schedule parameters, which are copied into local stack variables without bounds checking, potentially enabling arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Because the flaw allows for potential remote code execution, an attacker could gain persistent control over the range extender, facilitating lateral movement into the internal network, traffic interception, or total device denial of service. With a CVSS score of 8.8, this vulnerability is categorized as High, reflecting the significant impact on system integrity and availability.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Users should restrict administrative access to the affected devices and disable the port triggering feature if it is not strictly required.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /goform/portTriggerManageRule endpoint. Review system logs for signs of repeated service crashes or unexpected process restarts on the affected hardware.

Compensating Controls: Implement network segmentation to isolate these devices from critical internal assets. If possible, place these devices behind a firewall and restrict management interface access to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of August 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected binary.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant risk to organizational infrastructure. Administrators should prioritize isolating affected Linksys devices from untrusted network segments immediately. Since no vendor patch is currently available, constant vigilance and the application of the suggested compensating controls are mandatory until the vendor releases a firmware update.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321064","name":"VDB-321064 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 ipRangeBlockManageRule stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321064","name":"VDB-321064 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631533","name":"Submit #631533 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_29/29.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_29/29.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in multiple Linksys range extenders, allowing authenticated attackers to execute arbitrary code via the ipRangeBlockManageRule function.

Executive Summary:
A stack-based buffer overflow vulnerability in multiple Linksys range extenders allows authenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-9361

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists within the ipRangeBlockManageRule function of the /goform/ipRangeBlockManageRule endpoint. By supplying excessively long strings to the ipRangeBlockRuleName, scheduleIp, or ipRangeBlockRuleIpAddr parameters, an authenticated attacker can trigger a stack-based buffer overflow to execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain control over the affected network device. Given the device role as a network infrastructure component, this could facilitate unauthorized network access, traffic interception, or persistence within the local environment. With a CVSS score of 8.8, this flaw represents a significant risk to the confidentiality, integrity, and availability of network communications.

Remediation Plan

Immediate Action: As there is no official vendor patch currently available, users should restrict administrative access to the affected devices to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/ipRangeBlockManageRule endpoint, and review device logs for signs of unexpected service crashes or reboots.

Compensating Controls: Implement strict network segmentation and ensure that the management interface of these range extenders is not exposed to the public internet or untrusted internal segments.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of August 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to a lack of input validation on the affected parameters.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of a buffer overflow leading to potential code execution, organizations must treat this vulnerability with high priority. Since the vendor has not released a patch, immediate mitigation through network-level access controls and monitoring is essential to prevent unauthorized command execution on these devices.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321063","name":"VDB-321063 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 accessControlAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321063","name":"VDB-321063 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631532","name":"Submit #631532 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_28/28.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_28/28.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote authenticated attackers to crash the device or potentially execute arbitrary code via the accessControlAdd form.

Executive Summary:
A stack-based buffer overflow vulnerability in several Linksys range extender models poses a high risk of service disruption and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-9360

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the accessControlAdd function within the /goform/accessControlAdd endpoint. By sending a crafted POST request with excessively long ruleName or schedule parameters, an authenticated attacker can trigger a stack-based buffer overflow, leading to memory corruption.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the affected network device, resulting in a denial of service for connected clients. Given the CVSS score of 8.8, the potential for arbitrary code execution poses a significant threat to internal network integrity, as compromised extenders could serve as a pivot point for further lateral movement within the environment.

Remediation Plan

Immediate Action: Monitor the Linksys support portal for official firmware updates and apply them immediately upon release, as there is currently no patch available.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /goform/accessControlAdd endpoint, particularly those containing abnormally long string inputs.

Compensating Controls: Restrict administrative access to the management interface of these devices to trusted internal IP addresses only, and ensure that the web management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept exists as documented in the researcher write-up linked in the CVE references.

Analyst Notes: As of August 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it stems from a lack of input validation on a specific form parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of buffer overflow vulnerabilities, this issue should be prioritized for mitigation. Organizations should immediately restrict access to the management interfaces of the affected Linksys devices and prepare to deploy firmware updates as soon as the vendor provides a resolution.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321062","name":"VDB-321062 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_checkCredentialsByBBS stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321062","name":"VDB-321062 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631531","name":"Submit #631531 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_27/27.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_27/27.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.238Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the RP_checkCredentialsByBBS function of various Linksys range extenders allows remote attackers to trigger a crash or execute arbitrary code via malicious input.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extender models poses a significant risk of remote code execution and service disruption.

Vulnerability Details

CVE-ID: CVE-2025-9359

Affected Software: Linksys Range Extenders (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000)

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists within the /goform/RP_checkCredentialsByBBS endpoint, where the ssidhex and pwd parameters are processed without sufficient length validation. This lack of bounds checking allows an authenticated attacker to overwrite the function return address on the stack, leading to a memory corruption event that can cause device failure or arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability could result in a complete compromise of the affected network device, enabling an attacker to intercept traffic, pivot into internal network segments, or permanently disable critical connectivity infrastructure. Given the high CVSS score of 8.8, this flaw represents a severe threat to operational continuity and data integrity.

Remediation Plan

Immediate Action: Since no vendor patch is currently available, administrators should immediately restrict access to the device management interface to trusted management subnets only.

Proactive Monitoring: Monitor device logs for repeated service crashes, unusual POST requests directed at /goform/RP_checkCredentialsByBBS, or unexpected reboots of the range extender units.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level access control list to filter or block HTTP requests containing abnormally long strings in the ssidhex or pwd parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up provided by the vulnerability reporter.

Analyst Notes: As of August 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected binary.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations should isolate affected devices from untrusted network segments immediately and maintain strict access controls until the vendor releases a firmware update.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321061","name":"VDB-321061 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setSysAdm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321061","name":"VDB-321061 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631530","name":"Submit #631530 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_26/26.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_26/26.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.234Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setSysAdm function of Linksys range extenders allows remote attackers to crash the device via a crafted admpasshint parameter.

Executive Summary:
Multiple Linksys range extender models are vulnerable to a remotely exploitable stack-based buffer overflow, posing a severe risk of service disruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-9358

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) occurring in the /goform/setSysAdm endpoint. An attacker can trigger this condition by supplying an excessively long string to the admpasshint parameter, which lacks proper bounds checking.

Business Impact

Successful exploitation of this flaw can lead to a complete denial of service, rendering the range extender unresponsive and requiring a manual reboot. Given the CVSS score of 8.8, the vulnerability is classified as High severity. The potential for arbitrary code execution creates a significant risk of unauthorized administrative control over network infrastructure, which could facilitate lateral movement within the local environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict access to the web management interface to trusted IP addresses only, or disable remote management entirely.

Proactive Monitoring: Monitor device logs for frequent, unexplained reboots or abnormal traffic patterns directed toward the /goform/setSysAdm endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network filtering rule to drop incoming HTTP POST requests containing oversized admpasshint parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the research write-up linked in the CVE references.

Analyst Notes: As of August 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require complex preconditions to trigger the crash condition.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate operational risk. Administrators should isolate these devices from external network exposure immediately and monitor for vendor firmware updates, applying them as soon as they become available to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321060","name":"VDB-321060 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchByBBS stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321060","name":"VDB-321060 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631529","name":"Submit #631529 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_25/25.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_25/25.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.234Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the langSwitchByBBS function of various Linksys range extenders allows remote attackers to crash the system or execute arbitrary code via a crafted parameter.

Executive Summary:
Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that could allow remote attackers to compromise device integrity.

Vulnerability Details

CVE-ID: CVE-2025-9357

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the /goform/langSwitchByBBS endpoint. An attacker can trigger this condition by providing an excessively long string to the langSelectionOnly argument, which lacks proper input validation and leads to memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of system compromise. Successful exploitation results in a denial of service by crashing the device or, more severely, the potential for arbitrary code execution. This poses a significant threat to network infrastructure, potentially allowing attackers to intercept traffic or gain unauthorized control over range extenders within the environment.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch available. Administrators should immediately restrict network access to the management interface of affected devices to trusted IP ranges only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests targeting the /goform/langSwitchByBBS endpoint.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to inspect and block excessively long payloads directed at the management interface of these devices.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published technical write-up.

Analyst Notes: As of August 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the target function performs a direct copy of user-supplied input into a stack buffer without length checks.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability presents an elevated risk to network stability and security. Administrators must treat these devices as high-risk and implement strict network segmentation to prevent remote access until an official firmware update is released by Linksys.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321059","name":"VDB-321059 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 inboundFilterAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321059","name":"VDB-321059 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631528","name":"Submit #631528 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_24/24.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_24/24.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.974Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the inboundFilterAdd function of Linksys range extenders, allowing remote authenticated attackers to crash the device or execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote authenticated attackers to compromise device integrity and availability.

Vulnerability Details

CVE-ID: CVE-2025-9356

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability is a stack-based buffer overflow located in the inboundFilterAdd function within the /goform/inboundFilterAdd endpoint. Attackers with low privileges can trigger this overflow by sending a maliciously crafted ruleName parameter, which lacks proper input length validation, leading to memory corruption and potential code execution.

Business Impact

The exploitation of this vulnerability can lead to a complete denial of service for the affected network infrastructure, causing significant operational downtime. Furthermore, the potential for arbitrary code execution poses a severe risk of unauthorized access to the local network or sensitive configuration data, threatening the overall security posture of the environment. The CVSS score of 8.8 reflects the high severity of this flaw, particularly given the ability to achieve full system impact.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the management interface of the affected devices to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /goform/inboundFilterAdd, particularly those containing excessively long strings in the ruleName parameter.

Compensating Controls: Implement a Web Application Firewall or network access control list to filter and block traffic containing oversized input parameters directed at the range extender management console.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published technical write-up on GitHub.

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct handling of user input without length checks in the underlying binary.

Analyst Recommendation

Given the lack of a vendor-supplied patch and the availability of a public proof-of-concept, users must treat this vulnerability as a high-priority risk. Immediately isolate the management interfaces of these devices from untrusted networks and prepare to apply firmware updates as soon as Linksys releases a security patch.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.321058","name":"VDB-321058 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 scheduleAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321058","name":"VDB-321058 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631527","name":"Submit #631527 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.978Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys device firmware allows remote attackers to execute arbitrary code or crash the system via the /goform/scheduleAdd endpoint.

Executive Summary:
Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that permits remote code execution by an authenticated attacker.

Vulnerability Details

CVE-ID: CVE-2025-9355

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the scheduleAdd function within the /goform/scheduleAdd endpoint, where the ruleName parameter is copied into a local stack variable without sufficient bounds checking. This flaw allows a remote, authenticated attacker to overwrite the function return address, potentially leading to arbitrary code execution or a persistent denial of service.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the affected networking equipment. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device compromise, network traffic interception, or the complete loss of availability for the wireless range extender. Such an outcome would significantly disrupt business operations and potentially facilitate lateral movement within the internal network.

Remediation Plan

Immediate Action: Since no vendor patch is currently available, administrators should restrict access to the web management interface to trusted management IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Review device access logs and firewall traffic for repeated POST requests directed at the /goform/scheduleAdd endpoint, particularly those containing unusually long string values in the ruleName parameter.

Compensating Controls: Deploy Web Application Firewall (WAF) rules or network-based Intrusion Detection Systems (IDS) to inspect and block inbound HTTP POST requests containing oversized payloads targeting the vulnerable scheduling function.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's write-up hosted on GitHub.

Analyst Notes: As of August 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the targeted parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of a buffer overflow in networking hardware, organizations must prioritize the isolation of these devices. Administrators should ensure that the web administrative interface is not exposed to the public internet and limit access to authorized internal personnel until the vendor releases a firmware update to address the memory corruption.

---METADATA---
VENDOR: Linksys
PRODUCT: Range Extenders (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000)
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320784","name":"VDB-320784 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320784","name":"VDB-320784 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631526","name":"Submit #631526 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 Linksys Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.994Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys range extender firmware allows remote attackers to trigger a device crash or potentially execute arbitrary code via the ssidhex parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability exists in multiple Linksys range extenders that allows remote attackers to crash systems or potentially achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-9253

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow occurring in the RP_doSpecifySiteSurvey function within the mod_form.so binary. The vulnerability is triggered by sending an overly long ssidhex parameter to the /goform/RP_doSpecifySiteSurvey endpoint, which requires low privileges (authenticated access) to exploit.

Business Impact

Successful exploitation of this vulnerability could lead to a complete denial of service, rendering the range extender non-functional and disrupting network connectivity for connected clients. Given the CVSS score of 8.8, the risk is high: while the exploit currently results in a system crash, the underlying memory corruption primitives could potentially be leveraged for remote code execution, leading to full device compromise and unauthorized network access.

Remediation Plan

Immediate Action: Monitor official Linksys support channels for firmware updates, as the vendor has not yet provided a patch for this specific flaw. In the absence of a firmware fix, restrict access to the device management interface to trusted administrative IP addresses.

Proactive Monitoring: Review system logs for frequent crashes or unexpected reboots of range extender hardware. Monitor network traffic for anomalous POST requests directed at the /goform/RP_doSpecifySiteSurvey endpoint.

Compensating Controls: Implement strict network segmentation to isolate these devices from critical infrastructure. If possible, utilize a Web Application Firewall or similar network security appliance to block requests containing unusually long ssidhex parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher (Jiaqian Peng) and hosted on GitHub.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the ssidhex parameter, which directly overwrites the function return address.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS severity, organizations utilizing these Linksys models should treat this as a significant security risk. Network administrators must restrict management interface access immediately and prioritize the deployment of vendor-supplied firmware updates as soon as they become available to mitigate the potential for remote code execution.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320783","name":"VDB-320783 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DisablePasswordAlertRedirect stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320783","name":"VDB-320783 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631525","name":"Submit #631525 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_21/21.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.994Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Linksys range extenders allows remote, authenticated attackers to execute arbitrary code via the hint parameter in /goform/DisablePasswordAlertRedirect.

Executive Summary:
Multiple Linksys range extenders are vulnerable to a stack-based buffer overflow that could allow remote code execution by an authenticated attacker.

Vulnerability Details

CVE-ID: CVE-2025-9252

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the DisablePasswordAlertRedirect function of the /goform/DisablePasswordAlertRedirect endpoint. An authenticated attacker can supply an overly long string to the hint parameter, which is copied to a local stack variable without bounds checking, resulting in a buffer overflow that can be leveraged to overwrite the function return address.

Business Impact

The ability to execute arbitrary code on network infrastructure poses a significant risk to organizational security. Successful exploitation could lead to full device compromise, unauthorized access to internal network traffic, and potential persistence within the environment. Given the CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate attention to prevent lateral movement or interception of sensitive data.

Remediation Plan

Immediate Action: Since no official patch is currently available, restrict access to the web management interface of the affected devices to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor network traffic and device logs for irregular POST requests directed at the /goform/DisablePasswordAlertRedirect endpoint or unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long input strings within the hint parameter of HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher (Jiaqian Peng).

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on a documented administrative endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of buffer overflow vulnerabilities, this issue should be treated with high priority. Administrators must harden the management interface access immediately and maintain vigilance for vendor-provided firmware updates. Failure to mitigate this risk leaves critical network infrastructure exposed to potential remote takeover.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320782","name":"VDB-320782 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 sta_wps_pin stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320782","name":"VDB-320782 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631524","name":"Submit #631524 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_20/20.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.994Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys sta_wps_pin function allows remote attackers to crash the device or potentially execute arbitrary code via the Ssid parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to crash systems or potentially achieve code execution.

Vulnerability Details

CVE-ID: CVE-2025-9251

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the sta_wps_pin function within the /goform/sta_wps_pin endpoint. The vulnerability is triggered when an authenticated user sends an overly long string to the Ssid parameter, which lacks proper input validation and leads to memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service for the affected range extender, disrupting network connectivity for connected clients. With a CVSS score of 8.8, the potential for arbitrary code execution poses a significant risk to the integrity and availability of the local network infrastructure, as attackers could potentially gain persistent control over the device.

Remediation Plan

Immediate Action: Since no official patch is currently available from the vendor, users should restrict administrative access to the management interface of these devices to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /goform/sta_wps_pin URI.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level access control list (ACL) to block or sanitize traffic containing malformed or excessively long Ssid parameters targeting the vulnerable management interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept demonstrating the crash is available via the researcher's published technical write-up on GitHub.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the Ssid parameter handling.

Analyst Recommendation

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, users must prioritize isolating affected Linksys devices from public-facing network segments. Administrators should verify the firmware versions of their deployed units and maintain strict network access controls until a firmware update is released and verified.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320781","name":"VDB-320781 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setPWDbyBBS stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320781","name":"VDB-320781 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631523","name":"Submit #631523 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_19/19.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.994Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in multiple Linksys range extender models due to improper validation of the hint parameter in the setPWDbyBBS function, allowing remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote, authenticated attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-9250

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) triggered by an overly long input to the hint parameter within the /goform/setPWDbyBBS endpoint. The function fails to perform adequate bounds checking before copying the input to a local stack variable, which permits an authenticated attacker to overwrite the return address and execute arbitrary code.

Business Impact

Successful exploitation allows an attacker to gain full control over the affected range extender, potentially leading to unauthorized network access, interception of traffic, or complete system compromise. Given the high CVSS score of 8.8, this flaw represents a significant risk to network integrity and confidentiality, particularly in environments where these devices manage connectivity for critical assets.

Remediation Plan

Immediate Action: As there is currently no vendor-provided patch, administrators should restrict access to the web management interface of the affected devices to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device access logs for suspicious POST requests directed at the /goform/setPWDbyBBS endpoint, particularly those containing unusually large payloads in the hint parameter.

Compensating Controls: Implement network segmentation to isolate these extenders from sensitive internal network segments and deploy a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious traffic targeting the management interface.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the technical write-up provided by the researcher (Jiaqian Peng).

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation in the target function.

Analyst Recommendation

Given the lack of a vendor patch and the availability of a public proof-of-concept, users must prioritize securing their device configurations immediately. Administrators should treat these devices as potentially compromised if they have been exposed to untrusted networks and should move to replace or decommission the affected hardware if the vendor does not release a firmware update in a timely manner.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320780","name":"VDB-320780 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320780","name":"VDB-320780 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631522","name":"Submit #631522 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the Linksys DHCPReserveAddGroup function allows remote authenticated attackers to execute arbitrary code via crafted form parameters.

Executive Summary:
Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that could allow remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-9249

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) located in the DHCPReserveAddGroup function within the /goform/DHCPReserveAddGroup endpoint. The vulnerability is triggered when an authenticated attacker submits overly long data to the enable_group, name_group, ip_group, or mac_group parameters, which are copied to the stack without proper bounds checking.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected device, potentially leading to a complete compromise of the network infrastructure. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate unauthorized network access, data interception, or the use of the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: As no patch is currently available, restrict administrative access to the management interface of the affected devices and ensure they are not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/DHCPReserveAddGroup endpoint and inspect device logs for signs of repeated crashes or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to limit management access to known, trusted internal IP addresses only, effectively mitigating the risk of remote exploitation by unauthorized actors.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's technical write-up.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on critical form parameters.

Analyst Recommendation

Given the high severity and the availability of a public proof-of-concept, administrators should prioritize isolating these devices from external network exposure immediately. Users must remain vigilant for vendor-provided firmware updates and apply them as soon as they become available to permanently resolve the underlying memory corruption flaw.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320779","name":"VDB-320779 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_pingGatewayByBBS stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320779","name":"VDB-320779 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631521","name":"Submit #631521 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_17/17.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.686Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the RP_pingGatewayByBBS function of various Linksys range extenders allows remote authenticated attackers to execute arbitrary code via the ssidhex parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extender models poses a severe risk of remote code execution and persistent service denial.

Vulnerability Details

CVE-ID: CVE-2025-9248

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the /goform/RP_pingGatewayByBBS endpoint. An attacker with low-level privileges can supply an overly long string to the ssidhex parameter, which lacks proper bounds checking, allowing them to overwrite the function return address and potentially execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full control over the affected range extender device. Given the CVSS score of 8.8, this represents a high-severity risk: attackers could intercept network traffic, pivot into the local network, or cause permanent denial of service. The lack of a vendor-provided patch significantly elevates the impact on operational continuity and network integrity.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately isolate these devices from the public-facing internet and restrict administrative access to trusted management subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /goform/RP_pingGatewayByBBS endpoint, as well as unexpected device reboots or service instability.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to block malformed HTTP POST requests containing excessively long ssidhex parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's technical write-up on GitHub.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it involves a straightforward stack overflow in a common web-based management function.

Analyst Recommendation

Due to the absence of a vendor-supplied update and the public availability of exploit material, this vulnerability poses a significant risk to organizational infrastructure. IT teams must implement immediate network segmentation to isolate these devices and monitor for signs of compromise until the vendor provides a firmware resolution.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320778","name":"VDB-320778 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setVlan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320778","name":"VDB-320778 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631520","name":"Submit #631520 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_16/16.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.686Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setVlan function of multiple Linksys range extenders allows remote attackers to crash the system or execute arbitrary code via the vlan_set parameter.

Executive Summary:
Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code or cause a persistent denial of service.

Vulnerability Details

CVE-ID: CVE-2025-9247

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the setVlan function within the /goform/setVlan endpoint, where the vlan_set parameter fails to perform adequate bounds checking before copying data to a local stack variable. This flaw requires low-level authenticated access to trigger, allowing an attacker to overwrite the function return address and achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and availability. An attacker could gain unauthorized control over the affected range extender, potentially intercepting traffic or using the device as a pivot point to move laterally within the local network. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to complete system compromise and significant operational downtime.

Remediation Plan

Immediate Action: As no vendor patch is currently available, immediately restrict access to the web management interface of the affected devices to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/setVlan endpoint and review system logs for signs of recurrent device crashes or unauthorized management access.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network inspection tool to filter or block HTTP requests containing abnormally long strings in the vlan_set parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in a security research repository detailing the attack vector.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected form parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided security patch, users must prioritize isolating these devices from external network exposure. Administrators should ensure these devices are not reachable from the public internet and continue to monitor for official firmware updates from Linksys to remediate this memory corruption flaw permanently.

---METADATA---
VENDOR: Linksys
PRODUCT: Range Extenders (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000)
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320777","name":"VDB-320777 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 check_port_conflict stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320777","name":"VDB-320777 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631519","name":"Submit #631519 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_15/15.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.686Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in multiple Linksys range extenders, allowing remote attackers to crash the device or execute arbitrary code via the check_port_conflict function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to trigger memory corruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-9246

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the check_port_conflict function within the /goform/check_port_conflict endpoint, where the parameters single_port_rule and port_range_rule are processed without adequate length validation. This flaw enables a remote, authenticated attacker to overwrite the stack return address through a crafted HTTP POST request.

Business Impact

The exploitation of this vulnerability can lead to complete service disruption or remote code execution on network infrastructure devices. Given the CVSS score of 8.8, this poses a significant risk to network availability and integrity. Compromise of these devices could provide an attacker with a foothold to conduct further lateral movement within the local network environment.

Remediation Plan

Immediate Action: Since the vendor has not provided a security update, administrators should immediately restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the /goform/check_port_conflict endpoint and track device uptime for unexpected reboots.

Compensating Controls: Implement Web Application Firewall (WAF) rules or network access control lists to block or sanitize malicious input strings sent to the identified vulnerable parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the technical write-up provided by the researcher at the referenced GitHub repository.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the binary, which directly facilitates memory corruption.

Analyst Recommendation

Due to the lack of an official patch, the risk of exploitation remains high for all affected Linksys range extenders. Organizations must prioritize segmenting these devices from public-facing networks and enforce strict authentication controls until the vendor releases a firmware update to address this buffer overflow.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.320776","name":"VDB-320776 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 WPSSTAPINEnr stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320776","name":"VDB-320776 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631518","name":"Submit #631518 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_14/14.md","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:37.686Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in Linksys wireless range extenders allows authenticated remote attackers to crash the device or potentially execute arbitrary code via the ssid parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Linksys range extenders allows authenticated attackers to compromise device stability and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-9245

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) located in the WPSSTAPINEnr function of the /goform/WPSSTAPINEnr endpoint. The vulnerability is triggered when a low-privileged authenticated attacker sends a specially crafted, overly long string to the ssid parameter, which lacks proper bounds checking.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service, rendering the affected network infrastructure unusable. Given the potential for arbitrary code execution, an attacker could gain control over the range extender, facilitating lateral movement within the local network or interception of wireless traffic. With a CVSS score of 8.8, this flaw represents a significant risk to network availability and integrity.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface of the affected devices to trusted IP addresses only. Disable the WPS feature if it is not strictly required for network operations.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at the /goform/WPSSTAPINEnr endpoint, particularly those containing excessively large payloads in the ssid field.

Compensating Controls: Deploy a Web Application Firewall (WAF) or implement network access control lists to block unauthorized access to the management interface. Ensure that administrative interfaces are not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at the Institute of Information Engineering, Chinese Academy of Sciences.

Analyst Notes: As of August 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of the stack return address via a simple HTTP POST request.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses a credible threat to the integrity and availability of Linksys range extenders. Organizations must immediately isolate these devices from external access and restrict administrative interface entry to known, secure management networks to mitigate the risk of exploitation.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Up to 20250801
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319367","name":"VDB-319367 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchBack stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319367","name":"VDB-319367 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626698","name":"Submit #626698 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_38/38.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_38/38.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the langSwitchBack function of multiple Linksys range extenders allows remote attackers to trigger a crash or potentially execute arbitrary code via the langSelectionOnly parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to disrupt service or execute arbitrary code, necessitating immediate containment.

Vulnerability Details

CVE-ID: CVE-2025-8833

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: All firmware versions up to 20250801

Vulnerability: The vulnerability exists within the langSwitchBack function, located in the /goform/langSwitchBack endpoint, and is triggered by sending a crafted, overly long string to the langSelectionOnly argument. While the CVSS vector indicates PR:L (low privileges required), this flaw allows an authenticated attacker to perform remote code execution via a stack-based buffer overflow.

Business Impact

The potential for remote code execution poses a severe risk to network integrity and confidentiality, as an attacker could gain full control over the affected range extender. Given the CVSS score of 8.8, this vulnerability is classified as High severity, which could lead to unauthorized network access, interception of traffic, or permanent denial of service for connected devices.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators should immediately restrict access to the management interface of the affected devices to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/langSwitchBack endpoint, particularly those containing abnormally large payloads in the langSelectionOnly field.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the device administration interface and filter malicious HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the technical write-up provided by the researcher.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the public availability of a proof-of-concept, the exploitation risk should be treated as credible. The vulnerability stems from improper input validation in the binary, which is a common vector for memory corruption attacks.

Analyst Recommendation

Due to the lack of an available vendor patch, the risk of exploitation is elevated. Organizations using these Linksys range extenders must prioritize isolating these devices from the public internet and restricting management access to authorized personnel only. Continued monitoring for firmware updates is essential, and the devices should be updated immediately once the vendor releases a fix.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Various firmware versions up to 20250801
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319366","name":"VDB-319366 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setDMZ stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319366","name":"VDB-319366 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626697","name":"Submit #626697 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_48/48.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_48/48.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setDMZ function of various Linksys range extenders allows remote attackers to crash the device or potentially execute arbitrary code via the DMZIPAddress argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extender models poses a severe risk of remote service disruption and potential arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-8832

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: Firmware versions up to 20250801

Vulnerability: This vulnerability is a stack-based buffer overflow occurring in the setDMZ function within the /goform/setDMZ endpoint. An attacker with low-level privileges can supply a malformed DMZIPAddress parameter, which lacks necessary input validation, leading to memory corruption and potential code execution.

Business Impact

The ability to remotely trigger a buffer overflow in network infrastructure devices carries significant risk, including persistent denial of service and unauthorized system control. With a CVSS score of 8.8, this flaw represents a high-severity threat that could lead to the complete compromise of network segments if the device is used as a pivot point for further exploitation.

Remediation Plan

Immediate Action: As no vendor patch is currently available, administrators should restrict access to the management interface of the affected devices to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /goform/setDMZ endpoint or unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall or an Access Control List to block or sanitize traffic destined for the administrative /goform/ endpoints of these devices.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's write-up on GitHub.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the binary code.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided security update, immediate defensive action is required. Organizations should isolate the affected Linksys range extenders from external networks and monitor for signs of unauthorized access until an official firmware patch is released and applied.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Up to and including 20250801
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319365","name":"VDB-319365 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 remoteManagement stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319365","name":"VDB-319365 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626696","name":"Submit #626696 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_47/47.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_47/47.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the remoteManagement function of multiple Linksys range extenders allows remote, authenticated attackers to execute arbitrary code or crash the device.

Executive Summary:
Multiple Linksys range extenders are vulnerable to a critical stack-based buffer overflow that could allow remote code execution, necessitating immediate network isolation.

Vulnerability Details

CVE-ID: CVE-2025-8831

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: All firmware versions up to 20250801

Vulnerability: The vulnerability exists within the remoteManagement function of the /goform/remoteManagement endpoint. By supplying an overly long string to the portNumber parameter, an attacker with low privileges can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or a persistent denial of service.

Business Impact

Successful exploitation poses a severe risk to network integrity and availability. An attacker achieving remote code execution could gain full control over the network hardware, potentially facilitating lateral movement into the local network or intercepting traffic. Given the CVSS score of 8.8, this flaw is considered high severity, as it compromises the confidentiality, integrity, and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Disable remote management features on the affected devices immediately if they are exposed to the internet. Since no vendor patch is currently available, removing this attack vector is the only effective way to prevent exploitation.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/remoteManagement endpoint, specifically looking for abnormally long input strings in the portNumber parameter.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of these devices to trusted internal IP addresses only. A Web Application Firewall (WAF) or network access control list should be utilized to block external access to the device management interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via a published security research write-up on GitHub.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it lacks input validation on a user-controlled parameter.

Analyst Recommendation

The risk associated with this vulnerability is significant, especially given the availability of a public proof-of-concept. Organizations should prioritize isolating these devices from external networks until a vendor-supplied firmware update is released. Users are advised to monitor the official Linksys support site for firmware patches and to apply them as soon as they become available.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 20250801 and prior
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319360","name":"VDB-319360 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_setBasicAuto um_rp_autochannel stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319360","name":"VDB-319360 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626691","name":"Submit #626691 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_42/42.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_42/42.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the um_rp_autochannel function of Linksys range extenders allows remote, authenticated attackers to crash the device or potentially execute arbitrary code.

Executive Summary:
Multiple Linksys range extenders contain a critical stack-based buffer overflow vulnerability that allows remote attackers to compromise device stability and integrity.

Vulnerability Details

CVE-ID: CVE-2025-8826

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 20250801 and prior

Vulnerability: The vulnerability resides in the um_rp_autochannel function within the /goform/RP_setBasicAuto endpoint. By submitting an overly long string to the apcli_AuthMode_2G or apcli_AuthMode_5G parameters, an authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service, rendering the network range extender non-functional. Given the CVSS score of 8.8, the potential for arbitrary code execution poses a severe threat to network security, as attackers could gain control over the internal network infrastructure, leading to unauthorized access to sensitive traffic or further lateral movement within the environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators must restrict access to the web management interface of the affected Linksys devices to trusted management subnets only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /goform/RP_setBasicAuto, particularly those containing abnormally long strings in the authentication mode parameters.

Compensating Controls: Implement strict firewall rules to prevent unauthorized access to the web administration port (typically port 80/443) of the affected extenders, ensuring that only authorized administrators can reach the management interface.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in a security researcher's GitHub repository.

Analyst Notes: As of August 12, 2025, there is no public information indicating active exploitation in the wild. However, because the technical details and a functional proof-of-concept are publicly available, the risk of exploitation is elevated. The flaw is inherently dangerous due to the lack of input sanitization during the processing of authentication parameters.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators should isolate affected devices from untrusted network segments and monitor for any signs of anomalous traffic targeting the management interface. Until the vendor releases a firmware update, these access restrictions are the most effective defense against potential exploitation.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Linksys RE6250: 20250801, RE6300: 20250801, RE6350: 20250801, RE6500: 20250801, RE7000: 20250801, RE9000: 20250801
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319358","name":"VDB-319358 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setRIP stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319358","name":"VDB-319358 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626689","name":"Submit #626689 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_40/40.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_40/40.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
Linksys range extenders are vulnerable to a stack-based buffer overflow in the setRIP function, allowing remote attackers to crash the device or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to disrupt service or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-8824

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: All firmware versions up to 20250801

Vulnerability: This is a stack-based buffer overflow occurring in the setRIP function within the mod_form.so binary. An authenticated attacker can trigger this condition by sending an overly long string to the RIPmode or RIPpasswd arguments via the /goform/setRIP endpoint.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating high severity. Successful exploitation results in complete service disruption (denial of service) or the potential for arbitrary code execution on the networking hardware. This poses a significant risk to network availability and internal security, as compromised range extenders can serve as a persistent foothold for attackers within the local network environment.

Remediation Plan

Immediate Action: Monitor the Linksys support portal for firmware updates addressing this buffer overflow and apply them immediately to all affected devices.

Proactive Monitoring: Review device logs for unusual POST requests directed at the /goform/setRIP endpoint and monitor for unexpected service crashes or reboots.

Compensating Controls: Restrict management access to the web interface to trusted administrative IP addresses only, and utilize network segmentation to isolate these devices from critical infrastructure.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is publicly available via a researcher's GitHub repository.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation in the web form, which allows an attacker to overwrite the function return address.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to network integrity. Administrators should prioritize the deployment of vendor security updates as soon as they become available. In the interim, implement strict access controls for the device management interface to prevent unauthorized access to the vulnerable endpoint.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Up to 20250801
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319356","name":"VDB-319356 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setOpMode algDisable stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319356","name":"VDB-319356 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626686","name":"Submit #626686 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_56/56.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_56/56.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:44.678Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys range extender firmware allows an authenticated remote attacker to crash the system via the opMode parameter in the algDisable function.

Executive Summary:
A stack-based buffer overflow vulnerability in multiple Linksys range extenders allows an authenticated attacker to compromise system availability through remote code execution or service disruption.

Vulnerability Details

CVE-ID: CVE-2025-8822

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: Firmware versions up to 20250801

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the algDisable function within the mod_form.so binary. An authenticated attacker can trigger this condition by supplying an excessively long opMode argument via the /goform/setOpMode endpoint, which leads to memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the affected network hardware, resulting in a denial of service for connected clients. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized system control and significant network downtime. If the device serves as a critical infrastructure component, the impact on business operations could be severe.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch; users should restrict administrative access to the web interface to trusted management IP addresses only.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at /goform/setOpMode or /goform/algDisable, particularly those containing abnormally long string arguments.

Compensating Controls: Implement a Web Application Firewall or similar filtering mechanism to inspect and sanitize input parameters on management interfaces to block excessively long strings targeting the opMode field.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub repository.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input length validation in the affected function.

Analyst Recommendation

The presence of a public proof-of-concept and the nature of memory corruption vulnerabilities necessitate immediate attention. Because the vendor has not provided a patch, administrators must prioritize network segmentation and restrict access to the device management interfaces to prevent unauthorized users from reaching the vulnerable endpoints. Continue to monitor official Linksys support channels for firmware updates.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: Various (see vulnerability details)
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319354","name":"VDB-319354 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 wirelessBasic stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319354","name":"VDB-319354 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626684","name":"Submit #626684 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_54/54.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_54/54.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.146Z
---END_METADATA---

Description Summary:
Multiple Linksys range extenders are vulnerable to a stack-based buffer overflow via the wirelessBasic function, allowing an authenticated attacker to trigger a crash or potentially execute code.

Executive Summary:
A stack-based buffer overflow vulnerability in several Linksys range extenders allows authenticated attackers to compromise device availability or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-8820

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000.

Affected Versions: RE6500 (1.0.013.001), RE6250 (1.0.04.001), RE6300 (1.2.07.001), RE6350 (1.0.04.001), RE7000 (1.1.05.003), and RE9000 (1.0.04.002).

Vulnerability: The vulnerability exists in the wirelessBasic function within the /goform/wirelessBasic endpoint. An authenticated attacker can supply an excessively long string to the submit_SSID1 parameter, which triggers a stack-based buffer overflow and overrides the function return address.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to crash the affected network device, resulting in a denial of service for connected clients. With a CVSS score of 8.8, this vulnerability is considered high severity, as it provides a pathway for remote code execution, which could lead to full device takeover, interception of network traffic, or lateral movement within the local area network.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Organizations should restrict administrative access to the management interface to trusted users only and avoid exposing the device management portal to the internet.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at the /goform/wirelessBasic endpoint, especially those containing abnormally long strings in the submit_SSID1 parameter.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to restrict access to the device management interface, effectively preventing unauthorized or malicious input from reaching the vulnerable function.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up by Jiaqian Peng.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameter.

Analyst Recommendation

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, users of the affected Linksys devices must prioritize network-level isolation of the management interface. Administrators should monitor for firmware updates from Linksys and apply them immediately upon release to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 20250801 and prior
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319353","name":"VDB-319353 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setWan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319353","name":"VDB-319353 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626683","name":"Submit #626683 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_53/53.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_53/53.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.146Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setWan function of multiple Linksys range extenders allows authenticated attackers to execute arbitrary code via a crafted staticIp parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders poses a severe risk of arbitrary code execution and persistent service disruption.

Vulnerability Details

CVE-ID: CVE-2025-8819

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: 20250801 and prior

Vulnerability: The vulnerability exists in the setWan function of the affected devices where the staticIp argument is not properly validated before being processed. By sending an overly long string to the /goform/setWan endpoint, an authenticated attacker can trigger a stack-based buffer overflow, potentially overwriting the return address and executing arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected networking hardware. This could lead to full device compromise, unauthorized network access, or permanent denial of service, which would significantly disrupt business operations. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent lateral movement or infrastructure degradation.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the device management interfaces to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for unusual traffic patterns or repeated crashes, particularly involving requests to the /goform/setWan or /goform/setLan endpoints.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to prevent unauthorized or anomalous traffic from reaching the device management interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is publicly available via the researcher's GitHub write-up.

Analyst Notes: As of August 11, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable because the input handling lacks basic bounds checking, allowing for reliable memory corruption.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, makes it a priority for mitigation. Organizations relying on these Linksys range extenders should immediately isolate them from untrusted networks and restrict management access until a vendor-supplied firmware update is released. Monitoring for unauthorized configuration attempts is essential to detect potential exploitation efforts.

---METADATA---
VENDOR: Linksys
PRODUCT: Range Extender (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000)
AFFECTED_VERSIONS: 20250801 and earlier
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319351","name":"VDB-319351 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setLan stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319351","name":"VDB-319351 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626681","name":"Submit #626681 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_51/51.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_51/51.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:08.378Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setLan function of several Linksys range extenders allows remote attackers to execute arbitrary code or crash the device by providing malicious input.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to execute arbitrary code, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-8817

Affected Software: Linksys Range Extenders (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000)

Affected Versions: 20250801 and earlier

Vulnerability: The vulnerability exists within the setLan function, where the lan2enabled argument is processed without sufficient bounds checking. This memory corruption flaw allows an authenticated attacker to trigger a stack-based buffer overflow by sending an overly long string, which can eventually lead to arbitrary code execution when the input is copied to a local variable during subsequent processing.

Business Impact

Successful exploitation of this vulnerability can lead to a complete compromise of the affected range extender, enabling unauthorized access to the local network or denial of service. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, as compromised networking hardware can serve as a pivot point for further lateral movement within the corporate environment.

Remediation Plan

Immediate Action: Since a specific patch is not yet identified, administrators should restrict access to the web management interface to trusted internal segments only and monitor for anomalous POST requests to the /goform/setLan endpoint.

Proactive Monitoring: Security teams should review device logs for repeated crashes or unusual traffic patterns targeting the management interface, specifically monitoring for HTTP POST requests with abnormally long parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-based intrusion prevention system to filter or block requests containing excessively long strings directed at the /goform/setLan and /goform/setWan endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's GitHub repository as referenced in the CVE record.

Analyst Notes: As of August 11, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to internal network security. Organizations should prioritize isolating affected devices from the public internet and monitoring for any indicators of compromise until the vendor releases a firmware update to resolve the underlying buffer overflow.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
AFFECTED_VERSIONS: 20250801 and prior
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.319350","name":"VDB-319350 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setOpMode stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.319350","name":"VDB-319350 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.626680","name":"Submit #626680 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_50/50.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_50/50.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:08.374Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys web interface allows remote attackers to execute arbitrary code or cause a denial of service via the ethConv parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to achieve arbitrary code execution or crash the device.

Vulnerability Details

CVE-ID: CVE-2025-8816

Affected Software: Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000

Affected Versions: All firmware versions up to 20250801

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the setOpMode function within the mod_form.so library. An attacker can supply an excessively long string to the ethConv parameter during a POST request to the /goform/setOpMode endpoint, which subsequently leads to memory corruption in the setWan function and potential control of the function return address.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated or low-privileged remote attacker to execute arbitrary code with elevated permissions on the affected network device. This poses a severe risk to organizational network integrity, as compromised range extenders can be utilized as a pivot point for lateral movement, traffic interception, or permanent denial of service. The CVSS score of 8.8 reflects the high potential for total system compromise.

Remediation Plan

Immediate Action: As no vendor patch is currently available, administrators should restrict access to the device web management interface to trusted internal management subnets only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/setOpMode and /goform/setWan endpoints, and audit device logs for unexpected reboots or service interruptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to inspect and block excessively long HTTP POST payloads directed at the management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub repository.

Analyst Notes: As of August 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the ethConv parameter, which allows for direct memory corruption.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of the vulnerability, organizations should prioritize isolating these devices from the public internet. Ensure that administrative interfaces are not reachable from outside the local network and monitor vendor channels for future firmware releases that address this memory corruption flaw.

---METADATA---
VENDOR: Linksys
PRODUCT: E1200 v2 Router
AFFECTED_VERSIONS: Firmware E1200_v2.0.11.001_us.tar.gz
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.linksys.com/","name":null,"tags":[]},{"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60694.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.870Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys E1200 v2 httpd binary allows unauthenticated remote attackers to execute arbitrary code or trigger a denial of service via crafted HTTP requests.

Executive Summary:
A critical stack-based buffer overflow in Linksys E1200 v2 routers exposes devices to unauthenticated remote code execution or service disruption.

Vulnerability Details

CVE-ID: CVE-2025-60694

Affected Software: Linksys E1200 v2 Router

Affected Versions: Firmware E1200_v2.0.11.001_us.tar.gz

Vulnerability: The vulnerability exists in the validate_static_route function, where improper bounds checking during the processing of CGI parameters allows for memory corruption. This flaw is remotely exploitable by unauthenticated attackers.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to gain full control over the affected router or render it completely unresponsive. Given the CVSS score of 7.5, the risk is high: compromise of network infrastructure often leads to unauthorized access to internal network segments and sensitive data interception.

Remediation Plan

Immediate Action: Since no official patch is currently identified, isolate affected devices from public-facing network segments and restrict management access to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests targeting static route configuration parameters and review device logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement an edge firewall or intrusion prevention system to filter malicious HTTP traffic and block requests containing oversized parameters in the affected CGI fields.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced in the CVE record.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this memory corruption flaw makes it a highly attractive target for automated remote exploitation.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action to secure exposed infrastructure. Administrators must restrict access to the device management interface immediately and prioritize the application of vendor firmware updates as soon as they are released to remediate the underlying code vulnerability.

---METADATA---
VENDOR: Linksys
PRODUCT: E1200 v2 router
AFFECTED_VERSIONS: Firmware E1200_v2.0.11.001_us.tar.gz
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.linksys.com/","name":null,"tags":[]},{"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60691.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:40.870Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys E1200 v2 router httpd binary allows unauthenticated remote attackers to execute arbitrary code via the url CGI parameter.

Executive Summary:
A critical stack-based buffer overflow in Linksys E1200 v2 routers allows unauthenticated remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-60691

Affected Software: Linksys E1200 v2

Affected Versions: Firmware E1200_v2.0.11.001_us.tar.gz

Vulnerability: The vulnerability exists in the apply_cgi and block_cgi functions, which utilize sprintf to copy user-supplied input from the url CGI parameter into stack buffers without performing bounds checking. This flaw allows an unauthenticated attacker to trigger a buffer overflow by sending crafted HTTP requests.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the affected router, potentially leading to a complete compromise of the device. Given the CVSS score of 8.8, this poses a significant risk to network integrity, as compromised routers can be used to intercept traffic, redirect users to malicious sites, or serve as entry points for further lateral movement within the local network.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should immediately restrict access to the web management interface and isolate affected routers from the public internet.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests directed at the router, specifically looking for unusually long strings or malformed parameters within the url field.

Compensating Controls: Deploy a network-level firewall or Intrusion Prevention System (IPS) to filter incoming traffic and block unauthorized access to the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the CVE record.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the affected CGI functions.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a proof-of-concept, necessitates immediate action. Organizations utilizing Linksys E1200 v2 hardware should prioritize isolating these devices from external access until a vendor-supplied firmware update is verified and applied.

---METADATA---
VENDOR: Linksys
PRODUCT: E1200 v2 Router
AFFECTED_VERSIONS: Firmware E1200_v2.0.11.001_us.tar.gz
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.linksys.com/","name":null,"tags":[]},{"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60690.md","name":null,"tags":[]},{"url":"https://github.com/Jarrettgohxz/CVE-research/tree/main/Linksys/E1200-V2/CVE-2025-60690","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:01.734Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys E1200 v2 httpd binary allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service via crafted HTTP requests.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Linksys E1200 v2 routers allows unauthenticated remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-60690

Affected Software: Linksys E1200 v2 Router

Affected Versions: Firmware E1200_v2.0.11.001_us.tar.gz

Vulnerability: The vulnerability exists in the get_merge_ipaddr function of the httpd binary, where user-supplied CGI parameters are concatenated into a fixed-size buffer without bounds checking. This flaw allows an unauthenticated attacker to trigger a buffer overflow, potentially leading to arbitrary code execution or a denial of service condition.

Business Impact

A successful exploit grants an attacker the ability to execute arbitrary code with the privileges of the web server, which typically operates with high-level access on the device. This could lead to full device compromise, unauthorized network traffic interception, or permanent denial of service, severely impacting business continuity and data security. The CVSS score of 8.8 reflects the high severity and the potential for total impact on the affected system.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should isolate affected routers from the public internet immediately and restrict management access to trusted internal interfaces only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests directed at the router management interface, specifically looking for unusually long parameter strings or suspicious CGI call patterns.

Compensating Controls: Deploy a Web Application Firewall or router-level access control list to filter incoming traffic and block unauthorized attempts to reach the httpd management service.

Exploitation Status

Public Exploit Available: Yes, a public exploit exists as confirmed by an entry in ExploitDB and documented research.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a weaponized exploit in ExploitDB significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the availability of a public exploit and the high potential for remote code execution, this vulnerability represents an urgent security risk. Organizations utilizing Linksys E1200 v2 hardware must prioritize the isolation of these devices and monitor vendor channels closely for the release of a firmware update to resolve the underlying buffer overflow.

---METADATA---
VENDOR: Linksys
PRODUCT: E5600
AFFECTED_VERSIONS: V1.1.0.26
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_ddnsStatus/CI_ddnsStatus.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:01.058Z
---END_METADATA---

Description Summary:
Linksys E5600 firmware version V1.1.0.26 contains a command injection vulnerability in the ddnsStatus function, allowing unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in Linksys E5600 routers allows unauthenticated remote attackers to gain full control of the affected device.

Vulnerability Details

CVE-ID: CVE-2025-29229

Affected Software: Linksys E5600

Affected Versions: V1.1.0.26

Vulnerability: This is a command injection flaw located within the ddnsStatus function that does not require user authentication, enabling an attacker to execute arbitrary shell commands with elevated privileges.

Business Impact

The exploitation of this vulnerability poses a severe risk, as it allows for full remote code execution on the router. This can lead to total compromise of the network, unauthorized access to sensitive internal data, and the potential for the device to be used as a pivot point for further attacks on the internal infrastructure. With a CVSS score of 9.8, the urgency for remediation is extreme.

Remediation Plan

Immediate Action: As no official patch is currently identified, verify if a firmware update is available on the official Linksys support portal and apply it immediately if found.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or spikes in administrative activity originating from external sources.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and disable the Dynamic DNS (DDNS) feature if it is not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a technical write-up detailing the command injection vulnerability and providing a proof-of-concept is available via the researcher-provided GitHub reference.

Analyst Notes: As of Dec 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this command injection flaw and the availability of a public proof-of-concept, users must prioritize securing the affected Linksys E5600 devices. If a vendor-supplied firmware update is not yet available, immediately isolate the device from public-facing network segments and disable vulnerable services like DDNS to reduce the attack surface until a permanent patch can be deployed.

---METADATA---
VENDOR: Linksys
PRODUCT: E5600
AFFECTED_VERSIONS: V1.1.0.26
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Linksys E5600 firmware V1.1.0.26 contains a command injection vulnerability in the runtime.macClone function via the mc.ip parameter.

Executive Summary:
A critical command injection vulnerability in the Linksys E5600 router allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2025-29228

Affected Software: Linksys E5600

Affected Versions: V1.1.0.26

Vulnerability: This is a command injection vulnerability occurring within the runtime.macClone function. Because the vulnerability is reachable via the mc.ip parameter without requiring authentication, it allows for remote code execution.

Business Impact

Successful exploitation grants an attacker complete control over the affected router, potentially leading to unauthorized network access, interception of traffic, and the use of the device as a pivot point for lateral movement into the internal network. With a CVSS score of 9.8, the impact is considered critical due to the ease of remote exploitation and the potential for total system compromise.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, isolate the affected E5600 devices from the internet or disable the vulnerable MAC clone feature if possible until the vendor releases a firmware update.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell-related patterns originating from the router's management interface.

Compensating Controls: Ensure the router is behind a firewall that restricts management access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Dec 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of command injection flaws makes them highly susceptible to automated exploitation.

Analyst Recommendation

Given the critical CVSS severity and the existence of a proof-of-concept, users should treat this vulnerability with extreme urgency. Immediately restrict access to the device management interface and monitor vendor channels for the release of a patched firmware version.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.334525","name":"VDB-334525 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334525","name":"VDB-334525 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.697983","name":"Submit #697983 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:04.242Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the RE2000v2Repeater_get_wired_clientlist_setClientsName function of Linksys range extenders allows remote attackers to execute arbitrary code via the clientsname_0 parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2025-14136

Affected Software: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001

Vulnerability: The vulnerability exists within the mod_form.so library, specifically in the RE2000v2Repeater_get_wired_clientlist_setClientsName function, which fails to perform bounds checking on the clientsname_0 parameter. An authenticated attacker can provide an excessively long string to this parameter, causing a memory corruption that leads to a stack-based buffer overflow and potential remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve code execution on the affected network device, potentially compromising the integrity and availability of the local network infrastructure. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could lead to full device takeover, enabling lateral movement or man-in-the-middle attacks. Organizations relying on these devices for wireless connectivity face significant operational disruption and security exposure.

Remediation Plan

Immediate Action: Contact Linksys support or monitor the official Linksys security portal for firmware updates, as no official patch is currently identified for these models.

Proactive Monitoring: Review device access logs for unusual POST requests to the /goform/RE2000v2Repeater_get_wired_clientlist_setClientsName endpoint, especially those with abnormally large content lengths.

Compensating Controls: Restrict administrative access to these devices to trusted management IP addresses and ensure that only authorized users have access to the web interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of December 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation in the identified function.

Analyst Recommendation

Due to the presence of a public proof-of-concept and the high severity of the potential impact, this vulnerability requires immediate attention. Organizations should prioritize isolating affected devices from critical network segments until firmware updates are provided by the vendor. Ensure that administrative interfaces are not exposed to the public internet to prevent unauthorized exploitation.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.334524","name":"VDB-334524 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so AP_get_wired_clientlist_setClientsName stack-","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334524","name":"VDB-334524 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.697982","name":"Submit #697982 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_64/64.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_64/64.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:04.242Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Linksys range extenders allows remote attackers to execute arbitrary code via the clientsname_0 parameter in the AP_get_wired_clientlist_setClientsName function.

Executive Summary:
Multiple Linksys range extender models are vulnerable to a remote stack-based buffer overflow that could allow an attacker to gain control over the affected device.

Vulnerability Details

CVE-ID: CVE-2025-14135

Affected Software: Linksys (RE6500, RE6250, RE6300, RE6350, RE7000, RE9000)

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This is a stack-based buffer overflow (CWE-121) located in the mod_form.so library. An authenticated attacker can trigger the flaw by sending a specially crafted, overly long string to the clientsname_0 parameter within the AP_get_wired_clientlist_setClientsName function, leading to potential arbitrary code execution.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the web service, potentially leading to a full compromise of the network device. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate further lateral movement within the local network or interception of traffic.

Remediation Plan

Immediate Action: As there is no official vendor patch currently available, users should restrict administrative access to the web interface to trusted management IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/AP_get_wired_clientlist_setClientsName endpoint and investigate unexpected device reboots or service crashes.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize overly long input strings sent to the specified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at the referenced GitHub repository.

Analyst Notes: As of December 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameter.

Analyst Recommendation

Due to the absence of a vendor-provided patch and the availability of a public proof-of-concept, users are advised to isolate affected Linksys range extenders from untrusted networks. Until a firmware update is released, prioritize restricting management access and implementing compensating controls to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.334523","name":"VDB-334523 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334523","name":"VDB-334523 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.697981","name":"Submit #697981 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_63/63.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_63/63.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:04.242Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Linksys range extenders allows remote authenticated attackers to crash the device or potentially execute arbitrary code via the clientsname_0 parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple Linksys range extender models poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2025-14134

Affected Software: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: The vulnerability exists in the mod_form.so binary within the RE2000v2Repeater_get_wireless_clientlist_setClientsName function. An authenticated attacker can supply an overly long string to the clientsname_0 parameter, which lacks proper bounds checking, resulting in a stack-based buffer overflow that can overwrite the return address.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution, which could lead to a total compromise of the affected range extender. Given the CVSS score of 8.8, this represents a high-severity threat that could facilitate unauthorized network access, lateral movement, or the permanent disruption of critical wireless infrastructure, causing significant operational downtime.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, restrict administrative access to the management interface of the affected devices to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/RE2000v2Repeater_get_wireless_clientlist_setClientsName endpoint, especially those containing unusually large payloads.

Compensating Controls: Implement a Web Application Firewall or an Intrusion Prevention System rule to inspect and block excessively long strings sent to the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes: A functional proof-of-concept has been published in a researcher write-up on GitHub.

Analyst Notes: As of December 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct manipulation of a function parameter that lacks input validation.

Analyst Recommendation

The absence of a vendor-provided patch necessitates immediate defensive action to isolate these devices from untrusted network segments. Network administrators should treat this vulnerability with high urgency, as the availability of a public proof-of-concept significantly lowers the barrier to entry for potential attackers. Monitor vendor channels closely for firmware updates and apply them immediately upon release.

---METADATA---
VENDOR: Linksys
PRODUCT: RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000
AFFECTED_VERSIONS: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.334522","name":"VDB-334522 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so AP_get_wireless_clientlist_setClientsName sta","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334522","name":"VDB-334522 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.697980","name":"Submit #697980 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.0","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_62/62.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_62/62.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:04.242Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Linksys range extender function AP_get_wireless_clientlist_setClientsName allows remote attackers to trigger memory corruption via the clientsname_0 parameter.

Executive Summary:
A stack-based buffer overflow in multiple Linksys range extenders allows authenticated remote attackers to achieve arbitrary code execution via a crafted POST request.

Vulnerability Details

CVE-ID: CVE-2025-14133

Affected Software: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000

Affected Versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the mod_form.so library. An authenticated attacker can send a maliciously crafted HTTP POST request to the AP_get_wireless_clientlist_setClientsName endpoint, specifically manipulating the clientsname_0 parameter to overwrite the function return address.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk. Successful exploitation allows for arbitrary code execution, which could lead to full device compromise, unauthorized network access, or the deployment of persistent malware within the local network environment. Given that these devices often act as gateways or bridges, the potential for lateral movement and traffic interception poses a significant threat to internal data confidentiality and integrity.

Remediation Plan

Immediate Action: As there is currently no vendor-provided patch, users should restrict administrative access to the affected devices and ensure that the management interface is not exposed to the internet.

Proactive Monitoring: Security teams should monitor network logs for anomalous HTTP POST requests directed at the /goform/AP_get_wireless_clientlist_setClientsName endpoint, specifically looking for unusually long input strings in the clientsname_0 parameter.

Compensating Controls: Implement a Web Application Firewall or an Intrusion Prevention System policy to inspect and drop POST requests containing excessively large payloads targeting the vulnerable administrative endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a security researcher's GitHub repository.

Analyst Notes: As of December 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for direct control of the instruction pointer, facilitating remote code execution.

Analyst Recommendation

Due to the absence of a vendor-supplied patch and the public availability of a functional exploit, this vulnerability presents a significant risk to affected Linksys devices. Organizations must immediately isolate these devices from untrusted network segments and restrict administrative access to authorized personnel only. Continued vigilance is required until the vendor provides firmware updates to remediate the underlying memory corruption flaw.