Introduction
Remote attackers can gain code execution on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 wireless range extenders by exploiting a stack-based buffer overflow in the portRangeForwardAdd function. These extenders are widely deployed consumer and SMB networking devices. Public exploit code is available, and there is no vendor patch or official remediation guidance.
Technical information
CVE-2025-9482 is a stack-based buffer overflow in the portRangeForwardAdd function of Linksys RE series range extenders. An attacker triggers it by sending an HTTP POST request to the /goform/portRangeForwardAdd endpoint with oversized values in any of these parameters:
- ruleName
- schedule
- inboundFilter
- TCPPorts
- UDPPorts
The vulnerable function copies these parameters into fixed-size stack-allocated buffers without proper bounds checking. An attacker can overwrite adjacent stack memory this way, including the saved return address, which may lead to remote code execution. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Related vulnerabilities have been reported in the same product line and firmware versions, in other /goform/ endpoints such as scheduleAdd, qosClassifier, inboundFilterAdd, langSwitchByBBS, and addStaProfile. Each one involves similar unsafe string handling and missing input validation, which points to a systemic issue in the firmware codebase.
No official patch, detection method, or vendor advisory is available as of this writing. Public exploit code exists for similar vulnerabilities, and that significantly raises the risk of exploitation.
Affected systems and versions
The following Linksys RE series range extenders and firmware versions are affected:
- Linksys RE6250 (firmware 1.0.013.001)
- Linksys RE6300 (firmware 1.0.04.001)
- Linksys RE6350 (firmware 1.0.04.002)
- Linksys RE6500 (firmware 1.1.05.003)
- Linksys RE7000 (firmware 1.2.07.001)
- Linksys RE9000 (firmware 1.2.07.001)
Any configuration that exposes the /goform/portRangeForwardAdd endpoint is vulnerable.
Vendor security history
Linksys has a documented pattern of stack-based buffer overflows in the RE series, with multiple CVEs reported in 2025 against similar endpoints and parameters. The vendor has not responded to coordinated disclosure attempts and has not issued timely patches or advisories for these flaws. That record raises concerns about the maturity of Linksys's vulnerability management and secure development lifecycle for embedded products.
