CVE-2025-5444
Published: 02 June 2025
Summary
CVE-2025-5444 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as critical has been identified in multiple Linksys wireless range extender models, specifically the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The issue resides in the RP_UpgradeFWByBBS function within the /goform/RP_UpgradeFWByBBS endpoint, where unsanitized input to the type, ch, ssidhex, security, extch, pwd, mode, ip, nm, and gw parameters permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply crafted parameters to the affected endpoint and execute arbitrary operating-system commands on the device. Because the attack requires only low-privileged network access and no user interaction, an adversary who has obtained valid credentials or who can reach the web interface can leverage the injection to alter device configuration, exfiltrate data, or pivot within the local network. A public proof-of-concept has already been released.
The vendor was notified prior to disclosure but has not issued a response or patch. No official mitigation guidance appears in the available references, leaving users without vendor-supplied remediation steps. The associated EPSS score has remained flat at 0.0843 since publication, indicating no measurable increase in observed exploitation activity to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16647
Vulnerability details
A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this vulnerability is the function RP_UpgradeFWByBBS of the file /goform/RP_UpgradeFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os…
more
command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote OS command injection vulnerability (CWE-78) in the public-facing web management interface (/goform/RP_UpgradeFWByBBS) enables exploitation of a public-facing application (T1190) to execute arbitrary commands via Unix shell (T1059.004) on the affected Linksys Wi-Fi extender devices.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.