CVE-2025-9359
Published: 23 August 2025
Summary
CVE-2025-9359 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6500 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9359 is a stack-based buffer overflow vulnerability affecting the RP_checkCredentialsByBBS function in the /goform/RP_checkCredentialsByBBS file on Linksys range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000. The issue impacts firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001. It arises from manipulation of the ssidhex and pwd arguments, as identified under CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by an attacker with low privileges (PR:L) over the network (AV:N), requiring low complexity (AC:L) and no user interaction (UI:N). With a CVSS v3.1 base score of 8.8 (S:U/C:H/I:H/A:H), successful attacks can result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution, data compromise, or device denial of service.
Advisories on VulDB and a GitHub repository detail the vulnerability, including a proof-of-concept exploit. The vendor was contacted early for disclosure but provided no response, and no patches or mitigations are available from Linksys.
The exploit has been publicly released and could be exploited in the wild, published on 2025-08-23.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25636
Vulnerability details
A weakness has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkCredentialsByBBS. This manipulation of the argument ssidhex/pwd causes stack-based buffer overflow. The attack can be initiated…
more
remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote stack-based buffer overflow in the web form handler (/goform/RP_checkCredentialsByBBS) of an internet-exposed network device directly enables exploitation of a public-facing application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflows by validating ssidhex and pwd inputs at the RP_checkCredentialsByBBS function entry point.
Implements memory safeguards like stack canaries or address space layout randomization to block exploitation of the buffer overflow even with malformed inputs.
Requires timely identification, reporting, and patching of the buffer overflow flaw in affected Linksys firmware versions.