Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that could allow remote code execution.

This is a stack-based buffer overflow (CWE-121) located in the DHCPReserveAddGroup function within the /goform/DHCPReserveAddGroup endpoint. The vulnerability is triggered when an authenticated attacker submits overly long data to the enable_group, name_group, ip_group, or mac_group parameters, which are copied to the stack without proper bounds checking.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected device, potentially leading to a complete compromise of the network infrastructure. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate unauthorized network access, data interception, or the use of the device as a pivot point for further lateral movement within the internal network.

Immediate Action: As no patch is currently available, restrict administrative access to the management interface of the affected devices and ensure they are not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/DHCPReserveAddGroup endpoint and inspect device logs for signs of repeated crashes or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to limit management access to known, trusted internal IP addresses only, effectively mitigating the risk of remote exploitation by unauthorized actors.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's technical write-up.

Given the high severity and the availability of a public proof-of-concept, administrators should prioritize isolating these devices from external network exposure immediately. Users must remain vigilant for vendor-provided firmware updates and apply them as soon as they become available to permanently resolve the underlying memory corruption flaw.