Introduction
A stack-based buffer overflow in the web management interface of Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders lets remote attackers execute code on the device. No patch is available and public exploits are circulating, so a large population of consumer and SMB networks is exposed to compromise.
Linksys, part of Belkin and Foxconn, sells networking hardware worldwide and holds a significant share of the consumer and small business WiFi market. The RE series range extenders are widely deployed to extend wireless coverage, so vulnerabilities in these products affect millions of users worldwide.
Technical information
CVE-2025-9359 is a stack-based buffer overflow in the RP_checkCredentialsByBBS function, which is reachable through the /goform/RP_checkCredentialsByBBS endpoint on affected Linksys RE series devices. The function copies the ssidhex or pwd parameter from an HTTP POST request into a fixed-size stack buffer without properly checking its length.
An oversized value in either parameter makes the copy run past the buffer and corrupt stack memory. The overflow can overwrite the return address or function pointers on the stack, which gives the attacker arbitrary code execution in the context of the device firmware. The vulnerability is remotely exploitable and does not require authentication.
The issue is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The root cause is missing input length validation and unsafe memory handling in the web interface code. Public exploit code and detailed technical writeups are available, which puts exploitation within reach of a wide range of attackers.
Affected systems and versions
The following Linksys range extenders and firmware versions are affected:
- RE6250: 1.0.013.001
- RE6300: 1.0.04.001, 1.0.04.002
- RE6350: 1.0.04.001, 1.0.04.002
- RE6500: 1.1.05.003
- RE7000: 1.2.07.001
- RE9000: 1.2.07.001
All configurations with the web management interface enabled are vulnerable.
Vendor security history
Linksys has a documented history of similar vulnerabilities in the RE series firmware. Related CVEs include:
- CVE-2025-9355: Stack-based buffer overflow in
scheduleAddviaruleName - CVE-2025-9356: Stack-based buffer overflow in
inboundFilterAddviaruleName - CVE-2025-8832: Stack-based buffer overflow in
setDMZviaDMZIPAddress - CVE-2025-8833: Stack-based buffer overflow in
langSwitchBackvialangSelectionOnly
In every one of these cases, the vendor did not respond to coordinated disclosure attempts, and no official patch has been released. The pattern points to persistent problems in the vendor's secure development and vulnerability management practices.
