Introduction
Remote code execution on a network gateway can let attackers intercept traffic, deploy persistent malware, or pivot deeper into internal networks. CVE-2025-9526 is a stack-based buffer overflow in the Linksys E1700 router (firmware 1.0.0.4.003) that is remotely exploitable and requires no authentication. Public exploit code is available, and the vendor has not responded to disclosure attempts, so the device presents a significant attack surface to opportunistic and targeted attackers alike.
Technical information
CVE-2025-9526 is a stack-based buffer overflow in the setSysAdm function of the Linksys E1700 router, specifically firmware version 1.0.0.4.003. An attacker triggers it by sending an HTTP POST request to the /goform/setSysAdm endpoint with an overly long value in the rm_port parameter. The setSysAdm function copies this user-supplied parameter into a fixed-size stack buffer without proper bounds checking. The attacker can then overwrite adjacent stack memory, including the saved return address, and execute arbitrary code with root privileges.
Key technical details:
- Vulnerable endpoint:
/goform/setSysAdm - Vulnerable parameter:
rm_port(in POST data) - Vulnerable function:
setSysAdm - Firmware affected: 1.0.0.4.003 (Linksys E1700)
- Device architecture: MediaTek MT7620A SoC, Linux kernel 2.6.36
- No authentication required to trigger the vulnerability
The device runs an outdated Linux kernel and lacks modern exploit mitigations such as ASLR or stack canaries, which makes successful exploitation more likely. The technique is consistent with other recent Linksys buffer overflows, in which attacker-controlled data written past the end of a stack buffer corrupts the return address and hijacks control flow. No public code snippet for the vulnerable function is available, but related advisories document the exploitation method well.
Affected systems and versions
- Product: Linksys E1700 Wireless Router
- Firmware version: 1.0.0.4.003
- Public advisories confirm only this firmware version as affected
- The vulnerability is present regardless of configuration if the web management interface is accessible
Vendor security history
Linksys is a major consumer and SMB networking vendor. Multiple critical buffer overflow vulnerabilities have been reported in Linksys RE and E series products in 2025, including:
- CVE-2025-9355 (RE series, scheduleAdd function)
- CVE-2025-9358 (RE series, setSysAdm function)
- CVE-2025-9481 (RE series, setSysAdm function)
Several advisories report no vendor response or patch for these issues. Earlier incidents saw the same slow or absent response, including the 2019 Linksys Smart WiFi router information disclosure that affected over 25000 devices. The pattern raises concerns about Linksys's secure development lifecycle and the maturity of its vulnerability management.
