CVE-2025-5447
Published: 02 June 2025
Summary
CVE-2025-5447 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability has been identified in multiple Linksys wireless range extender models including the RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001. The issue resides in the ssid1MACFilter function within the /goform/ssid1MACFilter endpoint, where unsanitized input to parameters such as apselect_%d and newap_text_%d permits operating system command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply crafted values to the affected parameters and execute arbitrary operating system commands on the device. Successful exploitation yields limited control over confidentiality, integrity, and availability of the extender without requiring user interaction. Public proof-of-concept code has been released, and the vendor was notified prior to disclosure but provided no response.
The referenced advisories and disclosure entries on VulDB and GitHub contain no mitigation guidance or patch information, and the Linksys support site likewise shows no related firmware updates. The associated EPSS score has remained flat at 0.1030 with no observed increase after public release of the exploit details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16659
Vulnerability details
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argument apselect_%d/newap_text_%d leads to os command…
more
injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection via web form (/goform/ssid1MACFilter) enables exploitation of a public-facing application (T1190), exploitation of remote services (T1210), and execution via Unix Shell (T1059.004) on the affected Linksys Wi-Fi extenders.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.