CVE-2025-9244
Published: 20 August 2025
Summary
CVE-2025-9244 is a low-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
A security vulnerability has been identified in multiple Linksys wireless range extender models including the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw resides in the addStaticRoute function within the /goform/addStaticRoute endpoint, where unsanitized input to the staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, staticRoute_Metric_setting, and staticRoute_destType_setting parameters enables operating system command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 2.1.
An authenticated remote attacker can supply crafted values to the affected parameters and execute arbitrary operating system commands on the device. Because the attack vector is network-accessible and requires only low-privileged credentials, successful exploitation can lead to limited confidentiality, integrity, and availability impacts on the extender without user interaction. A public proof-of-concept has already been released.
The vendor was notified prior to disclosure but has not issued a response or patch. Public references, including a detailed technical write-up and VulDB entries, confirm the exploit is available for use, although the associated EPSS score has remained flat at 0.0158 with no observed increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25398
Vulnerability details
A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaticRoute of the file /goform/addStaticRoute. Such manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting/staticRoute_destType_setting leads to os command injection. The attack may…
more
be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote OS command injection vulnerability in the /goform/addStaticRoute web endpoint enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), indirect command execution (T1202), and abuse of Unix shell interpreters (T1059.004) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of the staticRoute_* arguments supplied to /goform/addStaticRoute, directly blocking the OS command injection vectors described in the CVE.
Limits which authenticated accounts are permitted to invoke addStaticRoute, reducing the population of low-privilege users who can reach the vulnerable function.
Disables or restricts the static-route configuration capability on the affected Linksys devices when the feature is not required, eliminating the attack surface.