CVE-2025-5439
📋 TL;DR
A critical OS command injection vulnerability in Linksys RE series WiFi extenders allows remote attackers to execute arbitrary commands on affected devices. The vulnerability exists in the verifyFacebookLike function and can be exploited by manipulating uid or accessToken parameters. All users of affected Linksys RE models with vulnerable firmware versions are at risk.
💻 Affected Systems
- Linksys RE6500
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, or use device as part of botnet.
Likely Case
Remote code execution leading to device takeover, credential theft, or denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires no authentication and uses simple HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.linksys.com/
Restart Required: Yes
Instructions:
1. Check Linksys website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot device after update. 4. Verify firmware version is no longer vulnerable.
🔧 Temporary Workarounds
Network Isolation
allPlace affected devices on isolated VLAN with no internet access and strict firewall rules.
Access Control
linuxBlock external access to device web interface (port 80/443) via firewall.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace vulnerable devices with different models or brands
- Disable affected devices entirely until patch available
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or using admin interface.Check Version:
curl -s http://[device-ip]/ | grep -i firmware || Check web interface manuallyVerify Fix Applied:
Verify firmware version is newer than affected versions listed above.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/verifyFacebookLike
- Suspicious command execution in system logs
- Multiple failed authentication attempts
Network Indicators:
- HTTP requests to /goform/verifyFacebookLike with shell metacharacters in parameters
- Outbound connections from extender to unknown IPs
SIEM Query:
source="extender_logs" AND (uri="/goform/verifyFacebookLike" OR cmd="*sh*" OR process="*bash*")