CVE-2025-8816
Published: 10 August 2025
Summary
CVE-2025-8816 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the stack-based buffer overflow by requiring validation of manipulated inputs like the ethConv argument at the /goform/setOpMode endpoint.
Implements memory safeguards such as stack canaries and DEP to protect against exploitation of the stack-based buffer overflow vulnerability.
Ensures timely identification, prioritization, and remediation of the specific buffer overflow flaw in affected Linksys range extender firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing web management interface (/goform/setOpMode) via the ethConv parameter enables remote code execution by exploiting a public-facing application.
NVD Description
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function setOpMode of the file /goform/setOpMode. The manipulation of the argument ethConv leads to stack-based buffer overflow. It is possible to…
more
launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-8816 is a stack-based buffer overflow vulnerability in the setOpMode function within the /goform/setOpMode endpoint on Linksys Wi-Fi range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions up to 20250801. The issue arises from improper handling of the ethConv argument, allowing manipulated input to overflow the stack. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker who has low privileges (such as authenticated access to the device) over the network, with low attack complexity and no user interaction required. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, potentially leading to arbitrary code execution, data compromise, or device disruption on the affected range extender.
Advisories from VulDB and related disclosures indicate no vendor response despite early notification, with no patches or mitigations released as of the CVE publication on 2025-08-10. A proof-of-concept exploit is publicly available on GitHub, increasing the risk of active exploitation.
The exploit has been disclosed to the public and may be used, though no evidence of widespread real-world attacks is reported in the available references.
Details
- CWE(s)