CVE-2025-9249
Published: 20 August 2025
Summary
CVE-2025-9249 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9249 is a stack-based buffer overflow vulnerability affecting the DHCPReserveAddGroup function in the /goform/DHCPReserveAddGroup file on Linksys Wi-Fi range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The issue arises from improper handling of the arguments enable_group, name_group, ip_group, and mac_group, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability can be exploited remotely over the network with low privileges (PR:L) and low complexity (AC:L), requiring no user interaction (UI:N) and carrying a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with network access and minimal authentication could manipulate the vulnerable arguments to trigger the buffer overflow, potentially achieving high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution on the affected device.
Advisories from VulDB (ctiid.320780, id.320780, submit.631522) detail the vulnerability and note that an exploit has been publicly disclosed via a GitHub repository (wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md), which may be utilized by attackers. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are mentioned in the available references, including the Linksys website. Security practitioners should isolate affected devices, monitor for exploitation attempts, and seek any unofficial firmware updates if they become available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25437
Vulnerability details
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack…
more
remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the web CGI endpoint /goform/DHCPReserveAddGroup allows remote code execution or denial of service on the Linksys range extender's public-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the stack-based buffer overflow by enforcing input validation and error handling on vulnerable arguments (enable_group, name_group, ip_group, mac_group) at the /goform/DHCPReserveAddGroup entry point.
Mitigates exploitation of the stack-based buffer overflow through memory safeguards like stack canaries, address space layout randomization, and non-executable stack protections.
Addresses the root cause by requiring timely identification, reporting, and correction of the buffer overflow flaw in affected Linksys firmware versions.