A critical stack-based buffer overflow vulnerability in multiple Linksys range extenders allows remote attackers to crash systems or potentially achieve code execution.

This is a stack-based buffer overflow (CWE-121) occurring in the sta_wps_pin function within the /goform/sta_wps_pin endpoint. The vulnerability is triggered when an authenticated user sends an overly long string to the Ssid parameter, which lacks proper input validation and leads to memory corruption.

Successful exploitation of this vulnerability can lead to a complete denial of service for the affected range extender, disrupting network connectivity for connected clients. With a CVSS score of 8.8, the potential for arbitrary code execution poses a significant risk to the integrity and availability of the local network infrastructure, as attackers could potentially gain persistent control over the device.

Immediate Action: Since no official patch is currently available from the vendor, users should restrict administrative access to the management interface of these devices to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /goform/sta_wps_pin URI.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level access control list (ACL) to block or sanitize traffic containing malformed or excessively long Ssid parameters targeting the vulnerable management interface.

Public Exploit Available: Yes, a proof-of-concept demonstrating the crash is available via the researcher's published technical write-up on GitHub.

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, users must prioritize isolating affected Linksys devices from public-facing network segments. Administrators should verify the firmware versions of their deployed units and maintain strict network access controls until a firmware update is released and verified.