CVE-2025-9360
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys WiFi range extenders allows remote attackers to execute arbitrary code by manipulating the ruleName/schedule parameters in the accessControlAdd function. This affects multiple RE series models running vulnerable firmware versions. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Device takeover enabling network traffic interception, credential theft, and use as pivot point for further attacks.
If Mitigated
Denial of service or temporary disruption if exploit fails or is blocked by network segmentation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Monitor Linksys security advisories for updates.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected range extenders from critical network segments and internet access.
Access Control List
linuxBlock access to port 80/443 on affected devices from untrusted networks.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected devices with different models or brands
- Disable affected devices entirely until vendor provides fix
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip]/ or using admin interface. Compare against affected versions.Check Version:
curl -s http://[device-ip]/ | grep -i firmware || Check web interface manuallyVerify Fix Applied:
No verification possible until vendor releases patch. Monitor for firmware updates.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/accessControlAdd
- Large ruleName or schedule parameters in web logs
- Device reboot or crash logs
Network Indicators:
- HTTP POST requests to vulnerable endpoint with oversized parameters
- Unusual outbound connections from range extender
SIEM Query:
source="web_logs" AND uri="/goform/accessControlAdd" AND (content_length>100 OR param_size>50)