CVE-2025-8827
Published: 11 August 2025
Summary
CVE-2025-8827 is a medium-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection via web form (/goform/RP_setBasicAuto.staticGateway) on public-facing Linksys range extenders enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), indirect command execution (T1202), and command/script interpreter abuse on network devices (T1059.008).
NVD Description
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of the file /goform/RP_setBasicAuto. The manipulation of the argument staticGateway leads to os command injection. The attack may…
more
be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-8827 is an OS command injection vulnerability affecting Linksys range extender models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 in versions up to 20250801. The flaw exists in the um_inspect_cross_band function within the /goform/RP_setBasicAuto file, where manipulation of the staticGateway argument enables injection of operating system commands. It is classified under CWE-77 and CWE-78.
The vulnerability allows remote exploitation by attackers possessing low privileges (PR:L), with low attack complexity (AC:L), no requirement for user interaction (UI:N), and network access (AV:N). Successful attacks result in low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), corresponding to a CVSS 3.1 base score of 6.3.
Advisories from VulDB and a GitHub repository detail the issue, including a publicly disclosed proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are referenced.
Details
- CWE(s)