CVE-2025-9250
Published: 20 August 2025
Summary
CVE-2025-9250 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9250 is a stack-based buffer overflow vulnerability affecting Linksys Wi-Fi range extenders, specifically the models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The issue resides in the setPWDbyBBS function within the /goform/setPWDbyBBS endpoint, where manipulation of the "hint" argument triggers the overflow.
The vulnerability can be exploited remotely over the network by an attacker with low privileges (PR:L), requiring no user interaction (UI:N) and low attack complexity (AC:L). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8. This could enable arbitrary code execution, potentially leading to full device compromise.
Advisories from VulDB detail the vulnerability (CTI ID 320781) and note that the vendor, Linksys, was contacted early but provided no response or patches. A proof-of-concept exploit is publicly available on GitHub, increasing the risk of active exploitation. Security practitioners should isolate affected devices and monitor for firmware updates, though none are confirmed available via the Linksys website.
Notable context includes the public availability of the exploit, which may facilitate widespread attacks on unpatched home and small office networks using these extenders. No evidence of in-the-wild exploitation is reported in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25406
Vulnerability details
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts the function setPWDbyBBS of the file /goform/setPWDbyBBS. Such manipulation of the argument hint leads to stack-based buffer overflow. It is possible to launch the…
more
attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remote web management endpoint (/goform/setPWDbyBBS) enables remote exploitation of a public-facing application for potential code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs like the 'hint' argument at the /goform/setPWDbyBBS endpoint to prevent stack-based buffer overflows.
SI-16 implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.
SI-2 mandates timely flaw remediation through firmware patching to address the identified buffer overflow in affected Linksys range extenders.