Multiple Linksys range extenders are vulnerable to a critical stack-based buffer overflow that could allow remote code execution, necessitating immediate network isolation.

The vulnerability exists within the remoteManagement function of the /goform/remoteManagement endpoint. By supplying an overly long string to the portNumber parameter, an attacker with low privileges can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or a persistent denial of service.

Successful exploitation poses a severe risk to network integrity and availability. An attacker achieving remote code execution could gain full control over the network hardware, potentially facilitating lateral movement into the local network or intercepting traffic. Given the CVSS score of 8.8, this flaw is considered high severity, as it compromises the confidentiality, integrity, and availability of the affected infrastructure.

Immediate Action: Disable remote management features on the affected devices immediately if they are exposed to the internet. Since no vendor patch is currently available, removing this attack vector is the only effective way to prevent exploitation.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/remoteManagement endpoint, specifically looking for abnormally long input strings in the portNumber parameter.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of these devices to trusted internal IP addresses only. A Web Application Firewall (WAF) or network access control list should be utilized to block external access to the device management interface.

Public Exploit Available: Yes, a proof-of-concept exploit is available via a published security research write-up on GitHub.

The risk associated with this vulnerability is significant, especially given the availability of a public proof-of-concept. Organizations should prioritize isolating these devices from external networks until a vendor-supplied firmware update is released. Users are advised to monitor the official Linksys support site for firmware patches and to apply them as soon as they become available.