CVE-2025-5446
Published: 02 June 2025
Summary
CVE-2025-5446 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as critical exists in multiple Linksys Wi-Fi range extender models including the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the RP_checkCredentialsByBBS function within the /goform/RP_checkCredentialsByBBS endpoint and stems from improper handling of the pwd argument, resulting in operating system command injection as indicated by CWE-77 and CWE-78. The issue can be triggered remotely without user interaction.
An authenticated remote attacker can supply a crafted pwd value to execute arbitrary operating system commands on the affected device. Successful exploitation grants the ability to run commands with the privileges of the web interface process, potentially leading to device compromise or further network access. The CVSS 4.0 score of 5.3 reflects limited impact across confidentiality, integrity, and availability vectors under low attack complexity.
Public references include a detailed proof-of-concept disclosure on GitHub along with entries on VulDB, while the vendor was notified prior to publication but provided no response or patch information. The associated EPSS score has remained flat at 0.0639 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16660
Vulnerability details
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been classified as critical. This affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkCredentialsByBBS. The manipulation of the argument pwd leads to os command injection.…
more
It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via unauthenticated remote web endpoint (/goform/RP_checkCredentialsByBBS) on Linux-based Linksys Wi-Fi extenders enables exploitation of public-facing application (T1190), exploitation of remote services (T1210), indirect command execution through web form (T1202), and Unix shell command execution (T1059.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.