CVE-2025-9483
Published: 26 August 2025
Summary
CVE-2025-9483 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys Re6500 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9483 is a stack-based buffer overflow vulnerability in the singlePortForwardAdd function within the /goform/singlePortForwardAdd file on Linksys Wi-Fi range extenders, specifically the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 models running firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, or 1.2.07.001. The issue stems from improper handling of the ruleName, schedule, or inboundFilter arguments (CWE-119, CWE-121), allowing remote attackers to trigger the overflow.
Attackers with low privileges (PR:L) can exploit this remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as scored at 8.8 by CVSS 3.1. Successful exploitation could enable arbitrary code execution, data tampering, or device denial of service on affected extenders.
Advisories from VulDB and a GitHub repository detail a published proof-of-concept exploit, confirming remote exploitability, but note that the vendor was contacted early without any response or patch release. Security practitioners should isolate affected devices and monitor for anomalous port forwarding activity until firmware updates are available.
An exploit has been publicly disclosed on GitHub, increasing the risk of active exploitation against unpatched devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25779
Vulnerability details
A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function singlePortForwardAdd of the file /goform/singlePortForwardAdd. This manipulation of the argument ruleName/schedule/inboundFilter causes stack-based buffer overflow. The attack is possible to be…
more
carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remotely accessible web interface (/goform/singlePortForwardAdd) enables exploitation of a public-facing application for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied inputs like ruleName, schedule, and inboundFilter to the singlePortForwardAdd function, preventing stack-based buffer overflows.
Provides memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of stack-based buffer overflows even if input validation fails.
Ensures timely identification, reporting, and patching of flaws like this buffer overflow vulnerability in affected Linksys firmware versions.