A critical stack-based buffer overflow vulnerability exists in multiple Linksys range extenders that allows remote attackers to crash systems or potentially achieve arbitrary code execution.

This is a stack-based buffer overflow occurring in the RP_doSpecifySiteSurvey function within the mod_form.so binary. The vulnerability is triggered by sending an overly long ssidhex parameter to the /goform/RP_doSpecifySiteSurvey endpoint, which requires low privileges (authenticated access) to exploit.

Successful exploitation of this vulnerability could lead to a complete denial of service, rendering the range extender non-functional and disrupting network connectivity for connected clients. Given the CVSS score of 8.8, the risk is high: while the exploit currently results in a system crash, the underlying memory corruption primitives could potentially be leveraged for remote code execution, leading to full device compromise and unauthorized network access.

Immediate Action: Monitor official Linksys support channels for firmware updates, as the vendor has not yet provided a patch for this specific flaw. In the absence of a firmware fix, restrict access to the device management interface to trusted administrative IP addresses.

Proactive Monitoring: Review system logs for frequent crashes or unexpected reboots of range extender hardware. Monitor network traffic for anomalous POST requests directed at the /goform/RP_doSpecifySiteSurvey endpoint.

Compensating Controls: Implement strict network segmentation to isolate these devices from critical infrastructure. If possible, utilize a Web Application Firewall or similar network security appliance to block requests containing unusually long ssidhex parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher (Jiaqian Peng) and hosted on GitHub.

Given the availability of a public proof-of-concept and the high CVSS severity, organizations utilizing these Linksys models should treat this as a significant security risk. Network administrators must restrict management interface access immediately and prioritize the deployment of vendor-supplied firmware updates as soon as they become available to mitigate the potential for remote code execution.