Introduction
Remote attackers can achieve arbitrary code execution on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders by exploiting a stack-based buffer overflow in the web management interface. The attack needs no authentication, and public exploit code is available. Millions of consumer and small-business networks are at risk of compromise.
Linksys is a major global vendor of consumer and SMB networking equipment, with a large installed base of wireless routers and range extenders. Homes and offices widely use the RE series to extend wireless coverage, so these devices are a significant target for attackers who want access to internal networks.
Technical information
CVE-2025-9357 is a stack-based buffer overflow in the langSwitchByBBS function, which is reachable through the HTTP endpoint /goform/langSwitchByBBS. The langSelectionOnly parameter triggers it: the firmware copies the parameter into a fixed-size stack buffer without proper bounds checking. A remote attacker can send an overlong value for langSelectionOnly that overwrites stack memory, including the return address, and may achieve arbitrary code execution.
The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The attack requires no authentication and works remotely over the network. Public exploit code is available for similar vulnerabilities in the same codebase, which makes exploitation more likely.
Researchers have reported multiple related CVEs (including CVE-2025-8833) in the same parameter and function family. Together they point to a systemic lack of input validation and memory safety controls in the Linksys RE series firmware. The root cause is unsafe string handling: the functions that copy user-supplied data do not check buffer boundaries.
Affected systems and versions
- Linksys RE6250 with firmware 1.0.013.001
- Linksys RE6300 with firmware 1.0.04.001 and 1.0.04.002
- Linksys RE6350 with firmware 1.0.04.001 and 1.0.04.002
- Linksys RE6500 with firmware 1.1.05.003
- Linksys RE7000 with firmware 1.2.07.001
- Linksys RE9000 with firmware 1.2.07.001
Any configuration running these firmware versions is vulnerable if the web management interface is accessible.
Vendor security history
Linksys has a documented history of stack-based buffer overflows and related memory safety issues in its RE series firmware. Multiple CVEs in 2025 (CVE-2025-8832, CVE-2025-8819, CVE-2025-8817, CVE-2025-8824, CVE-2025-8820, CVE-2025-8816, CVE-2025-8833) show a pattern of insufficient input validation and slow or absent vendor response. As of publication, Linksys has not provided patches or public statements for this issue.
References
- NVD entry for CVE-2025-9357
- Official CVE entry
- Original researcher writeup
- PoC reference
- Linksys official site
- CVE-2025-8832 analysis
- CVE-2025-8819 analysis
- CVE-2025-8817 analysis
- CVE-2025-8824 analysis
- CVE-2025-8820 analysis
- CVE-2025-8816 analysis
- CVE-2025-8833 analysis
- CVE-2025-8833 technical review
- Linksys response to IMDA
- Historical Linksys info disclosure
