CVE-2025-9360
Published: 23 August 2025
Summary
CVE-2025-9360 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the stack-based buffer overflow by enforcing validation of ruleName and schedule arguments to prevent improper memory operations.
Implements stack protection mechanisms like canaries or non-executable stacks to block exploitation of the buffer overflow vulnerability.
Requires timely remediation of the disclosed flaw through firmware updates or device replacement to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remote web endpoint (/goform/accessControlAdd) on Linksys range extenders enables exploitation of a public-facing application (T1190) and remote service (T1210) for potential code execution or denial of service.
NVD Description
A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Impacted is the function accessControlAdd of the file /goform/accessControlAdd. Such manipulation of the argument ruleName/schedule leads to stack-based buffer overflow. The attack can be…
more
launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-9360 is a stack-based buffer overflow vulnerability in the accessControlAdd function within the /goform/accessControlAdd file of Linksys Wi-Fi range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw arises from improper handling of the ruleName and schedule arguments, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity, and was published on 2025-08-23.
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user on the device, requiring no user interaction. Successful exploitation allows manipulation leading to a stack-based buffer overflow, potentially enabling arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Advisories from sources like VulDB note that a proof-of-concept exploit has been publicly disclosed on GitHub, including details and a POC at https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_28/28.md and https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_28/28.md#poc. The vendor was contacted early but provided no response, and no patches or mitigations are mentioned in the available references (https://vuldb.com/?ctiid.321063, https://vuldb.com/?id.321063, https://vuldb.com/?submit.631532).
The exploit disclosure increases the risk of active use in the wild against unpatched devices.
Details
- CWE(s)