CVE-2025-5443
Published: 02 June 2025
Summary
CVE-2025-5443 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability affects multiple Linksys wireless range extender models including the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the wirelessAdvancedHidden function within the /goform/wirelessAdvancedHidden endpoint, where unsanitized input to the ExtChSelector, 24GSelector, and 5GSelector parameters permits arbitrary command execution.
An authenticated remote attacker can supply crafted values to these parameters and execute operating system commands on the device. Successful exploitation grants the ability to alter wireless configuration, access or modify device data, and potentially disrupt service, all without requiring user interaction beyond network reachability.
Public references, including a detailed disclosure on GitHub and entries on VulDB, indicate that the vendor was notified prior to publication but provided no response or patch. No mitigation guidance or firmware updates are referenced in the available advisories.
The exploit code has been released publicly, and the EPSS score remains steady at 0.0843 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16649
Vulnerability details
A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the argument ExtChSelector/24GSelector/5GSelector leads to os command injection. It…
more
is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via web interface (/goform/wirelessAdvancedHidden) on Linksys Wi-Fi extenders enables remote exploitation of a public-facing application (T1190) and execution of commands on the network device CLI (T1059.008).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.