A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote, authenticated attackers to achieve arbitrary code execution or cause a denial of service.

The vulnerability is a stack-based buffer overflow (CWE-121) triggered by an overly long input to the hint parameter within the /goform/setPWDbyBBS endpoint. The function fails to perform adequate bounds checking before copying the input to a local stack variable, which permits an authenticated attacker to overwrite the return address and execute arbitrary code.

Successful exploitation allows an attacker to gain full control over the affected range extender, potentially leading to unauthorized network access, interception of traffic, or complete system compromise. Given the high CVSS score of 8.8, this flaw represents a significant risk to network integrity and confidentiality, particularly in environments where these devices manage connectivity for critical assets.

Immediate Action: As there is currently no vendor-provided patch, administrators should restrict access to the web management interface of the affected devices to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device access logs for suspicious POST requests directed at the /goform/setPWDbyBBS endpoint, particularly those containing unusually large payloads in the hint parameter.

Compensating Controls: Implement network segmentation to isolate these extenders from sensitive internal network segments and deploy a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious traffic targeting the management interface.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the technical write-up provided by the researcher (Jiaqian Peng).

Given the lack of a vendor patch and the availability of a public proof-of-concept, users must prioritize securing their device configurations immediately. Administrators should treat these devices as potentially compromised if they have been exposed to untrusted networks and should move to replace or decommission the affected hardware if the vendor does not release a firmware update in a timely manner.