CVE-2025-8818
Published: 10 August 2025
Summary
CVE-2025-8818 is a low-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
A vulnerability has been identified in multiple Linksys Wi-Fi range extender models including the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware up to 20250801. The issue resides in the setDFSSetting function within the /goform/setLan endpoint, where unsanitized input to the lanNetmask and lanIp parameters permits operating system command injection, corresponding to CWE-77 and CWE-78.
An authenticated remote attacker with low privileges can supply crafted values to these parameters and execute arbitrary commands on the device. The attack requires no user interaction and can be launched over the network, resulting in limited impacts to confidentiality, integrity, and availability as reflected in the CVSS 2.1 rating. A functional proof-of-concept has been published publicly.
The vendor was notified prior to disclosure but provided no response or patch. Public references include detailed exploit code and technical write-ups on GitHub along with entries in the Vuldb database. The associated EPSS score has remained flat at 0.0415 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24100
Vulnerability details
A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipulation of the argument lanNetmask/lanIp leads to os command injection.…
more
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via web interface parameters (lanNetmask/lanIp) in setDFSSetting enables exploitation of public-facing application (T1190), command and scripting interpreter execution (T1059, likely Unix Shell), and indirect command execution (T1202) on the Linksys range extender.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of lanNetmask/lanIp inputs to the /goform/setLan endpoint, blocking the OS command injection vector.
Limits the privileges of authenticated web-interface accounts so that even successful injection yields only the low-impact effects described in the CVSS vector.
Enables monitoring of setLan requests and anomalous command execution behavior on the extender, surfacing exploitation attempts against the disclosed PoC.