CVE-2025-9393
Published: 24 August 2025
Summary
CVE-2025-9393 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9393 is a stack-based buffer overflow vulnerability affecting the addStaProfile function in the /goform/addStaProfile component of Linksys Wi-Fi range extenders, specifically models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The flaw is triggered by manipulating parameters such as profile_name, Ssid, wep_key_1 through wep_key_4, wep_key_length, wep_default_key, cipher, or passphrase. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device due to the stack-based buffer overflow nature.
References, including a public proof-of-concept on GitHub and entries on VulDB, confirm remote exploitability but indicate no vendor response despite early notification; no patches or official mitigations are available. Security practitioners should isolate affected devices, monitor for anomalous traffic to the /goform/addStaProfile endpoint, and consider firmware downgrade or replacement if possible.
The exploit is public, increasing the risk of widespread abuse against unpatched Linksys extenders.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25650
Vulnerability details
A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaProfile of the file /goform/addStaProfile. Performing manipulation of the argument profile_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase results in stack-based buffer overflow. Remote exploitation of the attack…
more
is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remotely exploitable stack-based buffer overflow in the /goform/addStaProfile web endpoint enables exploitation of a public-facing application on vulnerable Linksys Wi-Fi range extenders.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the length and format of inputs such as profile_name, Ssid, wep_key_1-4, passphrase, and related parameters to prevent stack-based buffer overflows in the addStaProfile function.
Enforces memory protections like non-executable stacks, address space layout randomization, and stack guards to block arbitrary code execution from the stack-based buffer overflow.
Mandates identification, prioritization, and remediation of flaws like CVE-2025-9393 via patching, configuration hardening, or device isolation given the lack of vendor response.