CVE-2025-9392
Published: 24 August 2025
Summary
CVE-2025-9392 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9392 is a stack-based buffer overflow vulnerability affecting the qosClassifier function in the /goform/qosClassifier file of Linksys Wi-Fi range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000. The issue impacts firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001. It stems from manipulation of arguments including dir, sFromPort, sToPort, dFromPort, dToPort, protocol, layer7, dscp, and remark_dscp, as documented under CWEs-119 and CWE-121.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L) who have network access (AV:N). With a CVSS v3.1 base score of 8.8 (AC:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation requires low complexity and no user interaction, potentially granting high impacts on confidentiality, integrity, and availability, such as arbitrary code execution and full device compromise.
Advisories on VulDB and a GitHub repository detail the vulnerability, including a publicly disclosed proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are referenced in available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25733
Vulnerability details
A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function qosClassifier of the file /goform/qosClassifier. Such manipulation of the argument dir/sFromPort/sToPort/dFromPort/dToPort/protocol/layer7/dscp/remark_dscp leads to stack-based buffer overflow. The attack may be…
more
launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing web endpoint /goform/qosClassifier allows remote exploitation for potential remote code execution or denial of service on Linksys range extenders.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs like dir, ports, protocol, layer7, dscp, and remark_dscp parameters to prevent stack-based buffer overflows in the qosClassifier function.
SI-16 implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of stack-based buffer overflows.
SI-2 mandates identification, reporting, and correction of flaws like this buffer overflow, including timely patching of affected Linksys firmware versions.