CVE-2025-9355
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys RE series range extenders allows remote attackers to execute arbitrary code by manipulating the ruleName parameter in the scheduleAdd function. This affects multiple RE model devices running vulnerable firmware versions. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full device takeover, persistence installation, and lateral movement to connected networks.
Likely Case
Device compromise allowing attacker to modify settings, intercept traffic, or use device as pivot point for further attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Remote exploitation without authentication makes this highly accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Monitor Linksys support for firmware updates.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices on separate VLANs with strict firewall rules
Access Control
linuxBlock external access to device management interfaces
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected devices with non-vulnerable models
- Disable affected devices and use alternative network extension solutions
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or via serial consoleCheck Version:
curl -s http://[device-ip]/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is updated beyond affected versions (if patch becomes available)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/scheduleAdd
- Device reboot events
- Configuration changes without authorization
Network Indicators:
- HTTP requests with long ruleName parameters
- Traffic from device to unexpected external IPs
SIEM Query:
source="network_firewall" AND (url="/goform/scheduleAdd" OR (content_length>1000 AND url CONTAINS "goform"))🔗 References
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md#poc
- https://vuldb.com/?ctiid.321058
- https://vuldb.com/?id.321058
- https://vuldb.com/?submit.631527
- https://www.linksys.com/
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_23/23.md#poc
