CVE-2025-5438
Published: 02 June 2025
Summary
CVE-2025-5438 is a medium-severity Injection (CWE-74) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A command injection vulnerability affects the WPS functionality in the /goform/WPS endpoint of Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 wireless range extenders running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw stems from improper handling of the PIN argument and is tracked under CWE-74 and CWE-77, carrying a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply a crafted PIN value to execute arbitrary commands on the device. Successful exploitation grants limited control over confidentiality, integrity, and availability without requiring user interaction or elevated privileges beyond a standard account.
Public references include a detailed proof-of-concept on GitHub and entries in VulDB, but no vendor advisory or patch has been issued; the vendor was notified yet provided no response. The Linksys support site lists the affected products without mitigation guidance.
The exploit code has been publicly released. EPSS remains flat at 0.0841 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16624
Vulnerability details
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The manipulation of the argument PIN leads to…
more
command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.