Introduction
Remote attackers can gain code execution on Linksys RE series range extenders through a stack-based buffer overflow in the device's web interface. Public exploits are already available, and the vendor has not released a patch. The affected devices make up a significant portion of consumer and small business wireless infrastructure.
Linksys is one of the major vendors in the consumer and SMB networking market, with millions of devices deployed worldwide. Homes and offices use RE series range extenders to improve wireless coverage, so a vulnerability in these devices has a large effect on network security.
Technical information
CVE-2025-9392 is a stack-based buffer overflow in the qosClassifier function of the /goform/qosClassifier endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders. The vulnerability is present in firmware versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001.
The qosClassifier function copies user-supplied values for parameters such as dir, sFromPort, sToPort, dFromPort, dToPort, protocol, layer7, dscp, and remark_dscp into stack-allocated buffers without proper bounds checking. An HTTP POST request to /goform/qosClassifier with an excessively long value in any of these parameters overflows the buffer and corrupts the stack. This can let the attacker overwrite the function's return address and execute arbitrary code on the device.
The attack works remotely and needs no authentication. The affected firmware versions have no stack canaries, ASLR, or DEP, which makes exploitation more reliable. Because several parameters are vulnerable, attackers have more than one place to put a payload.
Proof of concept
A proof-of-concept exploit has been publicly disclosed. It sends a crafted HTTP POST request to /goform/qosClassifier with oversized values in parameters such as dir, sFromPort, sToPort, dFromPort, dToPort, protocol, layer7, dscp, and remark_dscp. The oversized input overwrites the stack and may lead to arbitrary code execution. The request works remotely and without authentication, which is what makes the flaw particularly dangerous, and the public PoC shows how easily it can be exploited.
References: https://vuldb.com/?id.321225
Affected systems and versions
- Linksys RE6250: firmware 1.0.013.001
- Linksys RE6300: firmware 1.0.04.001
- Linksys RE6350: firmware 1.0.04.002
- Linksys RE6500: firmware 1.1.05.003
- Linksys RE7000: firmware 1.2.07.001
- Linksys RE9000: firmware 1.2.07.001
Every configuration running these firmware versions is affected.
Vendor security history
The RE series has had a run of similar vulnerabilities throughout 2025, including several stack-based buffer overflows in web interface endpoints. Linksys has a documented pattern of not responding to coordinated disclosure attempts, and it has released no advisories or patches for several critical issues. That record suggests systemic problems in how the company develops firmware and manages vulnerabilities.
