CVE-2025-5445
Published: 02 June 2025
Summary
CVE-2025-5445 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as OS command injection affects multiple Linksys Wi-Fi range extender models including the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001 through 1.2.07.001. The flaw resides in the RP_checkFWByBBS function within the /goform/RP_checkFWByBBS endpoint, where unsanitized input supplied to the type, ch, ssidhex, security, extch, pwd, mode, ip, nm, and gw parameters is passed directly to the operating system.
An authenticated remote attacker can supply crafted values to these parameters and execute arbitrary operating-system commands on the device. Because the attack requires only low privileges and no user interaction, an adversary who has obtained valid credentials or who can reach the web interface can leverage the flaw to alter device configuration, exfiltrate data, or pivot within the local network.
Public references include a detailed proof-of-concept on GitHub, multiple VulDB entries, and the vendor’s site; the Linksys vendor was notified prior to disclosure but has issued no response or patch. The associated EPSS score remains flat at 0.0843 with no observed upward trajectory after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16651
Vulnerability details
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this issue is the function RP_checkFWByBBS of the file /goform/RP_checkFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command…
more
injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection via public-facing web endpoint (/goform/RP_checkFWByBBS) enables exploitation of public-facing application (T1190), Unix shell command execution (T1059.004), and indirect command execution (T1202).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.