CVE-2025-8828
Published: 11 August 2025
Summary
CVE-2025-8828 is a low-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2025-8828 is an OS command injection vulnerability affecting the ipv6cmd function in the /goform/setIpv6 endpoint of Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices up to firmware version 20250801. Unauthenticated manipulation of multiple IPv6 and PPPoE-related parameters, including Ipv6PriDns, Ipv6SecDns, Ipv6StaticGateway, pppoeUser, and several others, allows arbitrary command execution on the underlying system. The issue maps to CWE-77 and CWE-78 and carries a CVSS 4.0 score of 2.1.
An attacker with low-privileged network access can send a crafted HTTP request to the affected endpoint and achieve limited code execution on the device. Public proof-of-concept code has been released, confirming remote exploitability without user interaction.
No vendor patch or official advisory is available; the vendor was notified but did not respond. The EPSS score has remained flat at 0.0415 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24121
Vulnerability details
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argument Ipv6PriDns/Ipv6SecDns/Ipv6StaticGateway/LanIpv6Addr/LanPrefixLen/pppoeUser/pppoePass/pppoeIdleTime/pppoeRedialPeriod/Ipv6in4_PrefixLen/LocalIpv6/RemoteIpv4/LanIPv6_Prefix/LanPrefixLen/ipv6to4Relay/ipv6rdRelay/tunrd_PrefixLen/wan_UseLinkLocal/Ipv6StaticIp/Ipv6PrefixLen leads to os command injection. It is possible to…
more
launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the web-based IPv6 configuration (/goform/setIpv6) on Linksys range extenders enables remote exploitation of a public-facing application (T1190), indirect command execution via unsanitized inputs (T1202), and execution of Unix shell commands (T1059.004) on the likely Linux-based firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandatory validation and sanitization of all IPv6/PPPoE parameters passed to /goform/setIpv6 would block the unsanitized strings that enable OS command injection.
Disabling or restricting the ipv6cmd function and related IPv6 configuration interfaces on the device reduces the attack surface that the CVE exploits.
Continuous monitoring of CGI endpoint activity and unexpected process spawns on the extender can identify command-injection attempts in real time.