Introduction
An attacker who compromises a wireless range extender can gain a foothold inside a private network, past the perimeter defenses and within reach of sensitive traffic. CVE-2025-9356 is a high-severity stack-based buffer overflow in several widely deployed Linksys RE series range extenders. Public exploit code exists, and the vendor has not released a patch. The flaw is remotely exploitable without authentication, which puts both consumer and small business environments at significant risk.
Linksys is a major global networking hardware vendor that sells Wi-Fi routers, switches, and wireless extenders. The RE series is a popular line of range extenders built to increase wireless coverage in homes and offices, and these devices are common in residential and small business networks worldwide.
Technical information
CVE-2025-9356 is a stack-based buffer overflow in the inboundFilterAdd function of the Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders. An attacker triggers it by sending an HTTP request to the /goform/inboundFilterAdd endpoint with an overly long ruleName parameter. The function copies the ruleName value into a fixed-size buffer on the stack without adequate bounds checking, so the attacker can overwrite adjacent stack memory, including the saved return address, and execute arbitrary code.
The root cause is improper validation of the user-supplied ruleName parameter. The vulnerable code path does not check the length of the input before it copies the data to the stack buffer, so a remote attacker can craft a request that overflows the buffer and hijacks control flow. The flaw is present in multiple firmware versions, which indicates persistent insecure coding practices in the device firmware.
No authentication is required, and public exploit code is available, so exploitation is feasible for a wide range of attackers. The vulnerability resembles other stack-based buffer overflows reported in the same device family, such as CVE-2025-8824 (setRIP), CVE-2025-8819 (setWan), and CVE-2025-8822 (algDisable). All of them involve /goform/ endpoints and improper input validation.
Affected systems and versions
- Linksys RE6250 firmware 1.0.013.001
- Linksys RE6300 firmware 1.0.04.001
- Linksys RE6350 firmware 1.0.04.002
- Linksys RE6500 firmware 1.1.05.003
- Linksys RE7000 firmware 1.2.07.001
- Linksys RE9000 firmware 1.2.07.001
Every configuration running these firmware versions is vulnerable. The flaw is in the inboundFilterAdd function, which is reachable through the /goform/inboundFilterAdd endpoint.
Vendor security history
Linksys has a documented history of memory safety vulnerabilities in its RE series range extenders. Multiple CVEs have been reported in this product line for stack-based buffer overflows (CVE-2025-8824, CVE-2025-8819, CVE-2025-8822, CVE-2025-8816) and for OS command injection flaws. Linksys has responded poorly to coordinated disclosure. It has released no patches for several critical vulnerabilities, and it has not engaged with security researchers. Botnets such as TheMoon have exploited earlier Linksys vulnerabilities, so unpatched flaws in these devices carry real-world risk.
