CVE-2025-9527
Published: 27 August 2025
Summary
CVE-2025-9527 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Linksys E1700 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9527 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) in Linksys E1700 routers running firmware version 1.0.0.4.003. The flaw affects the QoSSetup function in the /goform/QoSSetup file, where manipulation of the ack_policy argument triggers the overflow. Published on 2025-08-27 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it enables remote exploitation.
An authenticated attacker with low privileges can exploit this vulnerability remotely by sending crafted requests to the affected endpoint. Successful exploitation could result in high-impact consequences, including arbitrary code execution, data compromise, system modification, or denial of service, due to the stack-based nature of the overflow.
No vendor patches or mitigations are available, as Linksys was contacted early about the disclosure but provided no response. A proof-of-concept exploit is publicly available, with details documented in GitHub repositories (e.g., https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md) and VulDB entries (e.g., https://vuldb.com/?ctiid.321544). Security practitioners should isolate affected devices and monitor for exploitation attempts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28865
Vulnerability details
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function QoSSetup of the file /goform/QoSSetup. Performing manipulation of the argument ack_policy results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public…
more
and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remotely exploitable stack-based buffer overflow in the Linksys E1700 router's web management interface (/goform/QoSSetup) enables adversaries to exploit a public-facing application for potential code execution or denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the ack_policy argument to directly prevent the stack-based buffer overflow in the QoSSetup function.
Implements memory protection mechanisms like stack canaries and non-executable stacks to block exploitation of stack-based buffer overflows.
Establishes processes to identify, report, and remediate flaws like CVE-2025-9527 through patching or compensatory controls such as isolation.