Multiple Linksys range extender models contain a critical stack-based buffer overflow vulnerability that permits remote code execution by an authenticated attacker.

The vulnerability exists in the scheduleAdd function within the /goform/scheduleAdd endpoint, where the ruleName parameter is copied into a local stack variable without sufficient bounds checking. This flaw allows a remote, authenticated attacker to overwrite the function return address, potentially leading to arbitrary code execution or a persistent denial of service.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the affected networking equipment. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device compromise, network traffic interception, or the complete loss of availability for the wireless range extender. Such an outcome would significantly disrupt business operations and potentially facilitate lateral movement within the internal network.

Immediate Action: Since no vendor patch is currently available, administrators should restrict access to the web management interface to trusted management IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Review device access logs and firewall traffic for repeated POST requests directed at the /goform/scheduleAdd endpoint, particularly those containing unusually long string values in the ruleName parameter.

Compensating Controls: Deploy Web Application Firewall (WAF) rules or network-based Intrusion Detection Systems (IDS) to inspect and block inbound HTTP POST requests containing oversized payloads targeting the vulnerable scheduling function.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the critical nature of a buffer overflow in networking hardware, organizations must prioritize the isolation of these devices. Administrators should ensure that the web administrative interface is not exposed to the public internet and limit access to authorized internal personnel until the vendor releases a firmware update to address the memory corruption.