CVE-2025-9363
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys RE series range extenders allows remote attackers to execute arbitrary code by manipulating the triggerRuleName/schedule arguments in the portTriggerManageRule function. This affects multiple Linksys RE models with specific firmware versions. Remote exploitation is possible without authentication.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence, lateral movement to connected networks, and data exfiltration.
Likely Case
Device takeover enabling network reconnaissance, man-in-the-middle attacks, and disruption of network services.
If Mitigated
Denial of service or limited impact if network segmentation and access controls prevent exploitation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Remote exploitation requires no authentication. Vendor unresponsive to disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check Linksys support site periodically for firmware updates.
🔧 Temporary Workarounds
Disable web management interface
allDisable remote access to the web management interface if not required.
Access device web interface > Administration > Management > Disable remote management
Network segmentation
allIsolate range extenders on separate VLAN with restricted access.
🧯 If You Can't Patch
- Replace affected devices with patched or different models
- Implement strict network access controls to limit device exposure
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface: Status > Firmware Version. If version matches affected list, device is vulnerable.Check Version:
curl -s http://device-ip/status.cgi | grep firmware_versionVerify Fix Applied:
Verify firmware version is updated to a version not in the affected list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/portTriggerManageRule
- Buffer overflow patterns in web logs
- Multiple failed exploitation attempts
Network Indicators:
- Unusual traffic to device management ports (typically 80/443)
- Exploit pattern matching in network traffic
SIEM Query:
source="device_logs" AND uri="/goform/portTriggerManageRule" AND (triggerRuleName OR schedule) AND size>normal