Multiple Linksys range extenders contain a critical stack-based buffer overflow vulnerability that allows remote attackers to compromise device stability and integrity.

The vulnerability resides in the um_rp_autochannel function within the /goform/RP_setBasicAuto endpoint. By submitting an overly long string to the apcli_AuthMode_2G or apcli_AuthMode_5G parameters, an authenticated attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution.

Successful exploitation of this vulnerability can lead to a complete denial of service, rendering the network range extender non-functional. Given the CVSS score of 8.8, the potential for arbitrary code execution poses a severe threat to network security, as attackers could gain control over the internal network infrastructure, leading to unauthorized access to sensitive traffic or further lateral movement within the environment.

Immediate Action: As no official patch is currently available, administrators must restrict access to the web management interface of the affected Linksys devices to trusted management subnets only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /goform/RP_setBasicAuto, particularly those containing abnormally long strings in the authentication mode parameters.

Compensating Controls: Implement strict firewall rules to prevent unauthorized access to the web administration port (typically port 80/443) of the affected extenders, ensuring that only authorized administrators can reach the management interface.

Public Exploit Available: Yes, a functional proof-of-concept has been published in a security researcher's GitHub repository.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators should isolate affected devices from untrusted network segments and monitor for any signs of anomalous traffic targeting the management interface. Until the vendor releases a firmware update, these access restrictions are the most effective defense against potential exploitation.