CVE-2025-9358
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys WiFi range extenders allows remote attackers to execute arbitrary code by manipulating the admpasshint parameter. This affects multiple RE series models running vulnerable firmware versions. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Device takeover enabling network traffic interception, credential theft, and participation in botnets.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Contact Linksys support for firmware update information. Consider replacing affected devices if no patch is forthcoming.
🔧 Temporary Workarounds
Disable Remote Administration
allDisable web administration interface access from external networks
Network Segmentation
allPlace range extenders on isolated VLANs with strict firewall rules
🧯 If You Can't Patch
- Immediately isolate affected devices from internet access using firewall rules
- Replace vulnerable devices with patched or different models if no firmware update becomes available
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or using the Linksys app. Compare against affected versions list.Check Version:
curl -s http://[device-ip]/ | grep -i firmware || Check web interface at http://[device-ip]/Verify Fix Applied:
Verify firmware version has been updated to a version not listed in affected versions. No specific fix verification available without vendor patch.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setSysAdm with long admpasshint parameters
- Device reboot or configuration changes without authorized action
Network Indicators:
- HTTP requests to device IPs on port 80 targeting /goform/setSysAdm
- Unusual outbound connections from range extenders
SIEM Query:
source="firewall" AND (dest_port=80 AND url_path="/goform/setSysAdm" AND http_method="POST")