CVE-2025-9481
📋 TL;DR
A stack-based buffer overflow vulnerability in Linksys RE series range extenders allows remote attackers to execute arbitrary code by manipulating the tunrd_Prefix parameter in the setIpv6 function. This affects multiple RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 models with vulnerable firmware versions. Remote exploitation is possible without authentication.
💻 Affected Systems
- Linksys RE6250
- Linksys RE6300
- Linksys RE6350
- Linksys RE6500
- Linksys RE7000
- Linksys RE9000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and potential lateral movement to other devices.
Likely Case
Device takeover enabling network traffic interception, DNS manipulation, or botnet recruitment.
If Mitigated
Denial of service or device crash if exploit fails or controls limit impact.
🎯 Exploit Status
Public proof-of-concept available on GitHub, remote exploitation without authentication, vendor unresponsive.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Monitor Linksys security advisories for updates.
🔧 Temporary Workarounds
Disable IPv6 functionality
allDisable IPv6 on affected devices to prevent exploitation via the vulnerable setIpv6 function.
Access device web interface > Advanced > IPv6 > Disable
Network segmentation
allIsolate affected devices on separate VLANs with strict firewall rules.
🧯 If You Can't Patch
- Immediately disconnect affected devices from networks until mitigation can be applied.
- Replace vulnerable devices with patched or different models if available.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface: Login > Administration > Firmware Upgrade.Check Version:
Check via web interface or attempt to access http://device-ip/status.aspVerify Fix Applied:
Verify firmware version is no longer in affected range and IPv6 is disabled if workaround applied.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setIpv6 with long tunrd_Prefix parameters
- Device crash/restart logs
Network Indicators:
- HTTP POST requests to /goform/setIpv6 with abnormal payload length
- Unexpected outbound connections from range extenders
SIEM Query:
http.url:"/goform/setIpv6" AND http.method:POST AND bytes_out:>500🔗 References
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md#poc
- https://vuldb.com/?ctiid.321396
- https://vuldb.com/?id.321396
- https://vuldb.com/?submit.634819
- https://www.linksys.com/
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md#poc
