CVE-2025-8819
Published: 10 August 2025
Summary
CVE-2025-8819 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-8819 is a stack-based buffer overflow vulnerability affecting the setWan function in the /goform/setWan endpoint on Linksys Wi-Fi range extenders, including models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions up to 20250801. The issue arises from improper handling of the staticIp argument, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited remotely by an attacker with low privileges (such as an authenticated user on the device) over the network, requiring no user interaction. Successful exploitation of the buffer overflow may allow arbitrary code execution, leading to high confidentiality, integrity, and availability impacts, potentially enabling full device compromise, data theft, or further network pivoting.
Advisories from VulDB (ctiid.319353, id.319353) and a public GitHub disclosure detail the vulnerability, including a proof-of-concept (POC) for reproduction. The vendor was notified early but has not responded or issued patches, leaving affected devices unmitigated; security practitioners should isolate exposed extenders, monitor for anomalous traffic to /goform/setWan, and consider firmware updates if released.
The exploit has been publicly disclosed and may be actively used, heightening risks for unpatched deployments in home and small office networks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24099
Vulnerability details
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function setWan of the file /goform/setWan. The manipulation of the argument staticIp leads to stack-based buffer overflow. It is possible to…
more
initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public web endpoint (/goform/setWan) directly enables remote code execution via exploitation of a network-accessible application interface.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the stack-based buffer overflow by validating the staticIp argument in the /goform/setWan endpoint against bounds and format restrictions.
Mitigates successful exploitation of the stack buffer overflow through memory protections like DEP, ASLR, and stack canaries.
Requires timely identification, testing, and application of firmware patches or workarounds to remediate the disclosed buffer overflow vulnerability.