A critical stack-based buffer overflow vulnerability in Linksys range extenders allows authenticated attackers to compromise device stability and potentially execute arbitrary code.

This is a stack-based buffer overflow (CWE-121) located in the WPSSTAPINEnr function of the /goform/WPSSTAPINEnr endpoint. The vulnerability is triggered when a low-privileged authenticated attacker sends a specially crafted, overly long string to the ssid parameter, which lacks proper bounds checking.

Successful exploitation of this vulnerability can lead to a complete denial of service, rendering the affected network infrastructure unusable. Given the potential for arbitrary code execution, an attacker could gain control over the range extender, facilitating lateral movement within the local network or interception of wireless traffic. With a CVSS score of 8.8, this flaw represents a significant risk to network availability and integrity.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface of the affected devices to trusted IP addresses only. Disable the WPS feature if it is not strictly required for network operations.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at the /goform/WPSSTAPINEnr endpoint, particularly those containing excessively large payloads in the ssid field.

Compensating Controls: Deploy a Web Application Firewall (WAF) or implement network access control lists to block unauthorized access to the management interface. Ensure that administrative interfaces are not exposed to the public internet.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at the Institute of Information Engineering, Chinese Academy of Sciences.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses a credible threat to the integrity and availability of Linksys range extenders. Organizations must immediately isolate these devices from external access and restrict administrative interface entry to known, secure management networks to mitigate the risk of exploitation.