CVE-2025-9248
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys RE-series range extenders allows remote attackers to execute arbitrary code by manipulating the ssidhex parameter. This affects multiple RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 models running vulnerable firmware versions. Attackers can exploit this from remote locations without authentication.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement into connected networks, and persistent backdoor installation.
Likely Case
Device crash/reboot (DoS) or limited code execution to modify device settings and intercept network traffic.
If Mitigated
If properly segmented and firewalled, impact limited to the range extender itself without network access.
🎯 Exploit Status
Public exploit code exists on GitHub. Attack requires sending crafted HTTP request to /goform/RP_pingGatewayByBBS endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.linksys.com/
Restart Required: Yes
Instructions:
1. Check Linksys website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot device after update. Note: Vendor has not responded to disclosure.
🔧 Temporary Workarounds
Network Segmentation
allIsolate range extenders on separate VLAN without internet access
Access Control
linuxBlock external access to range extender web interface (port 80/TCP)
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace vulnerable devices with different models or brands
- Disable range extender functionality and use as access point only if supported
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface (typically http://[extender-ip]/). If version matches affected list, device is vulnerable.Check Version:
curl -s http://[extender-ip]/ | grep -i firmwareVerify Fix Applied:
After firmware update, verify version no longer matches affected versions list.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/RP_pingGatewayByBBS with unusual ssidhex parameter length
- Device reboot/crash logs
Network Indicators:
- Unusual HTTP traffic to range extender port 80 with long parameter values
- Multiple connection attempts to /goform/RP_pingGatewayByBBS
SIEM Query:
source="firewall" AND dest_port=80 AND url_path="/goform/RP_pingGatewayByBBS" AND (param_length>100 OR contains(param_value,"ssidhex"))