Multiple Linksys range extenders are vulnerable to a critical buffer overflow that could allow remote code execution by an authenticated attacker.

The vulnerability exists in the setIpv6 function within the /goform/setIpv6 endpoint. By sending a crafted POST request with an excessively long tunrd_Prefix parameter, an authenticated attacker can trigger a buffer overflow, leading to memory corruption and potential arbitrary code execution.

Successful exploitation of this vulnerability allows a remote attacker to gain control over the affected network device. This could lead to a complete compromise of the device, enabling the attacker to intercept network traffic, pivot into the local network, or cause persistent denial of service. With a CVSS score of 8.8, this represents a high-severity risk to network integrity and confidentiality.

Immediate Action: There is currently no vendor-provided patch available; administrators should restrict access to the management interface to trusted IP addresses only and disable administrative access from the WAN side immediately.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /goform/setIpv6 endpoint, particularly those containing abnormally long string arguments.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long inputs targeting the tunrd_Prefix parameter in administrative forms.

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub write-up referenced in the CVE record.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to the security of the affected network environment. Because no vendor patch has been released, organizations must prioritize network-level segmentation and restrict administrative access to mitigate the threat until an official firmware update is made available.