Introduction
A stack-based buffer overflow in the setIpv6 function lets remote attackers gain code execution on Linksys RE series range extenders, which are widely deployed. The vulnerability affects millions of consumer and small business networks. Public exploit code is already available, and at the time of writing Linksys has released no patch or advisory.
Linksys is a major networking hardware vendor that sells worldwide into consumer and SMB markets. Its RE series range extenders are commonly used to extend WiFi coverage in homes and offices. This product line has had similar vulnerabilities before, and public sources indicate a pattern of slow or absent response from the company to coordinated security disclosures.
Technical information
CVE-2025-9481 is a stack-based buffer overflow in the setIpv6 function, which is reachable through the /goform/setIpv6 HTTP endpoint on affected Linksys RE series devices. The function copies user-supplied data from the tunrd_Prefix parameter of an HTTP POST request into a fixed-size stack buffer without checking its length. An attacker can use this to overwrite adjacent stack memory, including the return address, and execute arbitrary code.
In brief:
- An HTTP POST to
/goform/setIpv6with an oversizedtunrd_Prefixvalue triggers the vulnerable code path. - Exploitation requires no authentication.
- The flaw is present in multiple firmware versions, which points to a systemic problem with input validation.
- Public exploit code exists, which lowers the bar for attackers.
Neither the vendor nor any advisory has published an official code snippet. The external research linked below has further technical details and exploit references.
Affected systems and versions
These Linksys RE series models and firmware versions are affected:
- RE6250: 1.0.013.001
- RE6300: 1.0.04.001
- RE6350: 1.0.04.002
- RE6500: 1.1.05.003
- RE7000: 1.2.07.001
- RE9000: 1.2.07.001
Any configuration that exposes the /goform/setIpv6 endpoint is vulnerable.
Vendor security history
Linksys has had multiple critical buffer overflow vulnerabilities in the same RE series product line, including:
- CVE-2025-9355 (scheduleAdd endpoint)
- CVE-2025-8826 (various endpoints)
- CVE-2025-9357 (other /goform/ endpoints)
- CVE-2025-8831 (remoteManagement endpoint)
Public sources report that the vendor has responded slowly, or not at all, to coordinated disclosure. As of the publication date, Linksys has released no patches or advisories for these issues.
