CVE-2025-9355
Published: 22 August 2025
Summary
CVE-2025-9355 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9355 is a stack-based buffer overflow vulnerability affecting the scheduleAdd function in the /goform/scheduleAdd file of Linksys range extender models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000. The flaw is present in firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001. It stems from manipulation of the ruleName argument and is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring low attack complexity, no user interaction, and no privileged scope escalation. With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
VulDB advisories and related disclosures, including a public proof-of-concept on GitHub, indicate that the vendor was contacted early for coordinated disclosure but provided no response or patches. No official mitigations or firmware updates are available as of publication on 2025-08-22. The exploit has been made public and could be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28836
Vulnerability details
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function scheduleAdd of the file /goform/scheduleAdd. Performing manipulation of the argument ruleName results in stack-based buffer overflow. The attack is…
more
possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remote web interface (/goform/scheduleAdd) enables remote code execution on public-facing Linksys Wi-Fi range extenders.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflow by validating and rejecting oversized or malformed ruleName inputs to the scheduleAdd function.
Implements memory protection mechanisms like stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow even if invalid input reaches the function.
Requires timely flaw remediation through vulnerability scanning, patching firmware flaws, or removing vulnerable Linksys range extender models from the environment.