CVE-2025-5440
Published: 02 June 2025
Summary
CVE-2025-5440 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability has been identified in multiple Linksys wireless range extender models including the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the NTP function within the /goform/NTP endpoint, where unsanitized input to the manual_year_select, manual_month_select, manual_day_select, manual_hour_select, manual_min_select, and manual_sec_select parameters allows arbitrary command execution. The issue is tracked under CWE-77 and CWE-78 with a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply crafted values to these parameters to inject and execute operating system commands on the affected device. Public exploit code has already been released, enabling potential compromise of device integrity, confidentiality, and availability without requiring user interaction.
The vendor was notified prior to disclosure but has not issued a response or patch. The associated EPSS score remains flat at 0.0539 with no observed increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16629
Vulnerability details
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument manual_year_select/manual_month_select/manual_day_select/manual_hour_select/manual_min_select/manual_sec_select leads to os command injection. It is…
more
possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via web interface (/goform/NTP) on public-facing Linksys range extenders enables remote exploitation (T1190), Unix shell command execution (T1059.004), and indirect command execution (T1202) as noted in advisory.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.