CVE-2025-5442
Published: 02 June 2025
Summary
CVE-2025-5442 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability affects multiple Linksys wireless range extender models, specifically RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the RP_pingGatewayByBBS function within the /goform/RP_pingGatewayByBBS endpoint, where unsanitized input to the ip, nm, and gw parameters allows arbitrary command execution.
An authenticated remote attacker can supply crafted values to these parameters to inject and execute operating system commands on the device. Successful exploitation grants the ability to run arbitrary code with the privileges of the web server process, potentially leading to device takeover, configuration changes, or use as a pivot point within the local network. The issue was publicly disclosed with an available proof-of-concept, and the vendor did not respond to early notification.
The EPSS score remains flat at 0.0639 with no material increase since disclosure, indicating limited observed exploitation interest to date. Public references include a detailed technical write-up and exploit on GitHub along with entries in the VulDB database, while the vendor's site provides no published advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16642
Vulnerability details
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command…
more
injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection via unauthenticated web form (/goform/RP_pingGatewayByBBS) in Linksys Wi-Fi extenders enables exploitation of public-facing application (T1190), network device command execution (T1059.008), and indirect command execution through ping gateway function (T1202).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.