CVE-2025-9244
📋 TL;DR
This CVE describes an OS command injection vulnerability in Linksys RE series range extenders. Attackers can remotely execute arbitrary commands by manipulating parameters in the addStaticRoute function. All users of affected Linksys RE models with vulnerable firmware versions are at risk.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to install persistent backdoors, pivot to internal networks, or use device as botnet node.
Likely Case
Unauthorized access to device configuration, network reconnaissance, or launching attacks against other devices on the network.
If Mitigated
Limited impact if device is isolated or network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires network access to device web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://www.linksys.com/
Restart Required: No
Instructions:
Check Linksys support site for firmware updates. No official patch confirmed as vendor has not responded to disclosure.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to device web interface
Network segmentation
allIsolate range extenders on separate VLAN
🧯 If You Can't Patch
- Replace affected devices with non-vulnerable models
- Implement strict firewall rules to block all inbound traffic to device management interface
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or using device management app.Check Version:
curl -s http://[device-ip]/ | grep firmware version or check device web interfaceVerify Fix Applied:
Verify firmware version is no longer in affected range. Test if addStaticRoute endpoint responds to command injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/addStaticRoute with shell metacharacters
- Failed authentication attempts to device management interface
Network Indicators:
- Unexpected outbound connections from range extender
- Traffic to suspicious IPs from device
SIEM Query:
source="linksys-extender" AND (url="/goform/addStaticRoute" OR cmd="*;*" OR cmd="*|*")