CVE-2025-5441
Published: 02 June 2025
Summary
CVE-2025-5441 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability affects multiple Linksys Wi-Fi range extender models, specifically the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the setDeviceURL function of the /goform/setDeviceURL endpoint, where unsanitized input to the DeviceURL argument allows arbitrary command execution and is classified under CWE-77 and CWE-78.
An attacker with low-privileged network access can remotely supply a malicious DeviceURL value to trigger command injection on the device. Public exploit code has been released, enabling potential unauthorized command execution, though the CVSS 4.0 score of 5.3 reflects the need for authenticated access and limits the immediate blast radius.
The vendor was contacted before disclosure but did not respond, and no patches or mitigation steps are documented in the referenced sources. The EPSS score has remained flat at 0.0639 with no material rise after public release of the details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16645
Vulnerability details
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The manipulation of the argument DeviceURL leads to os command injection. The attack…
more
can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the remote web endpoint (/goform/setDeviceURL) enables exploitation of a public-facing application (T1190) for initial access and indirect command execution (T1202) via injected OS commands.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.