Cyber Resilience

CVE-2025-9483

HighPublic PoC

Published: 26 August 2025

Published
26 August 2025
Modified
02 September 2025
KEV Added
Patch
CVSS Score v4 7.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0052 67.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9483 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6500 Firmware. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-9483 is a stack-based buffer overflow vulnerability in the singlePortForwardAdd function within the /goform/singlePortForwardAdd file on Linksys Wi-Fi range extenders, specifically the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 models running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The issue stems from improper handling of the ruleName, schedule, or inboundFilter arguments (CWE-119, CWE-121), allowing remote attackers to trigger the overflow.

Attackers with low privileges (PR:L) can exploit this remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as scored at 8.8 by CVSS 3.1. Successful exploitation could enable arbitrary code execution, data tampering, or device denial of service on affected extenders.

Advisories from VulDB and a GitHub repository detail a published proof-of-concept exploit, confirming remote exploitability, but note that the vendor was contacted early without any response or patch release. Security practitioners should isolate affected devices and monitor for anomalous port forwarding activity until firmware updates are available.

An exploit has been publicly disclosed on GitHub, increasing the risk of active exploitation against unpatched devices.

EU & UK References

Vulnerability details

A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function singlePortForwardAdd of the file /goform/singlePortForwardAdd. This manipulation of the argument ruleName/schedule/inboundFilter causes stack-based buffer overflow. The attack is possible to be…

more

carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in the remotely accessible web interface (/goform/singlePortForwardAdd) enables exploitation of a public-facing application for initial access.

CVEs Like This One

CVE-2025-9247Same product: Linksys Re6250
CVE-2025-8819Same product: Linksys Re6250
CVE-2025-8817Same product: Linksys Re6250
CVE-2025-9249Same product: Linksys Re6250
CVE-2025-8816Same product: Linksys Re6250
CVE-2025-14134Same product: Linksys Re6250
CVE-2025-9359Same product: Linksys Re6250
CVE-2025-9245Same product: Linksys Re6250
CVE-2025-9250Same product: Linksys Re6250
CVE-2025-9252Same product: Linksys Re6250

Affected Assets

linksys
re6500 firmware
1.0.013.001
linksys
re6250 firmware
1.0.04.001
linksys
re6300 firmware
1.2.07.001
linksys
re6350 firmware
1.0.04.001
linksys
re7000 firmware
1.1.05.003
linksys
re9000 firmware
1.0.04.002

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user-supplied inputs like ruleName, schedule, and inboundFilter to the singlePortForwardAdd function, preventing stack-based buffer overflows.

prevent

Provides memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of stack-based buffer overflows even if input validation fails.

prevent

Ensures timely identification, reporting, and patching of flaws like this buffer overflow vulnerability in affected Linksys firmware versions.

References