CVE-2025-9245
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys WiFi range extenders allows remote attackers to execute arbitrary code by manipulating the SSID parameter in the WPSSTAPINEnr function. This affects multiple RE series models running vulnerable firmware versions. Remote exploitation is possible without authentication.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to connected networks, and persistent backdoor installation.
Likely Case
Device crash/reboot (DoS) or limited code execution to modify device settings, intercept network traffic, or join botnets.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists on GitHub. Remote exploitation requires no authentication. The vulnerability is in a web form handler accessible via HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.linksys.com/
Restart Required: Yes
Instructions:
1. Check Linksys website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot device after update. Note: As of analysis, vendor has not responded or released patches.
🔧 Temporary Workarounds
Disable WPS and web administration
allDisable WPS functionality and restrict web administration access to reduce attack surface
Network segmentation and firewall rules
allIsolate range extenders on separate VLANs and block external access to management interfaces
🧯 If You Can't Patch
- Replace vulnerable devices with patched or different models
- Implement strict network segmentation to isolate range extenders from critical assets
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or using admin interface. Compare against affected versions.Check Version:
curl -s http://[device-ip]/ | grep -i firmware || Check web interface manuallyVerify Fix Applied:
Verify firmware version has been updated to a version not listed in affected versions. Test if /goform/WPSSTAPINEnr endpoint still responds.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/WPSSTAPINEnr
- Unusually long SSID parameter values in web logs
- Device reboot/crash logs
Network Indicators:
- HTTP POST requests to /goform/WPSSTAPINEnr with oversized SSID parameters
- Unexpected outbound connections from range extenders
SIEM Query:
source="web_logs" AND uri="/goform/WPSSTAPINEnr" AND (param_length(ssid) > 100 OR status_code=500)