CVE-2025-8829
Published: 11 August 2025
Summary
CVE-2025-8829 is a low-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in multiple Linksys wireless range extender models including the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 up to firmware version 20250801. The issue resides in the um_red function within the /goform/RP_setBasicAuto endpoint, where improper handling of the hname argument permits operating system command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 2.1.
An authenticated remote attacker can supply a crafted hname value to execute arbitrary commands on the device. Public proof-of-concept code has been released, enabling potential unauthorized access or modification of device behavior, though the low CVSS rating reflects the need for valid credentials.
No vendor patch or mitigation guidance has been issued, as Linksys did not respond to early disclosure attempts. The associated EPSS score has remained flat at 0.0415 with no observed increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24120
Vulnerability details
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_red of the file /goform/RP_setBasicAuto. The manipulation of the argument hname leads to os command injection. The…
more
attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via remote web parameter (hname) in public-facing management interface enables exploitation of public-facing applications (T1190), Unix shell execution (T1059.004), and indirect command execution (T1202).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks OS command injection by validating/sanitizing the hname argument before it reaches um_red in /goform/RP_setBasicAuto.
Enforces access restrictions on the RP_setBasicAuto endpoint so that even authenticated low-privilege sessions cannot execute injected OS commands.
Limits privileges of the web-process user and restricts available system commands, reducing the impact of any successful hname injection.