Linksys RE Extenders CVE-2025-14133

Exploitation requires network access to the device's HTTP management interface and the ability to invoke the AP_get_wireless_clientlist_setClientsName handler in mod_form.so with a manipulated clientsname_0 parameter. The CVSS vector (PR:L) indicates low-privilege authentication to the web interface is needed, which limits fully anonymous exploitation; there is no user-interaction requirement (UI:N) and complexity is low (AC:L). Practical risk is bounded by exposure of the extender's management interface - typically LAN-facing rather than WAN-facing - and by the absence of any vendor patch, since the vendor did not respond to disclosure. Affected firmware: RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 at versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001.

This is a stack-based buffer overflow (CWE-119) in the mod_form.so CGI handler of several Linksys RE-series WiFi range extenders. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring low-level authentication and yielding high confidentiality, integrity and availability impact on the device - consistent with memory-corruption leading to code execution or crash on an embedded MIPS/ARM appliance. Countervailing signals temper the raw score: EPSS is very low at 0.11% (30th percentile), the vulnerability is NOT on the CISA KEV list, and the CVSS carries E:P (Proof-of-Concept exploit maturity) rather than active exploitation. A public POC does exist (wudipjq/my_vuln GitHub write-up), so exploitability is demonstrated, but publicly available exploit code is a distinct signal from active exploitation - there is no evidence of the latter. The realistic priority is moderate: a working POC against consumer/SOHO range extenders whose vendor did not respond to disclosure (no patch), offset by low EPSS, no KEV, and the PR:L authentication gate. Note a metadata tension: NVD/CVSS assigns CWE-119 (general buffer overflow) while the description specifies a stack-based overflow, better modeled as CWE-121 - a refinement, not a contradiction.

An attacker with low-privilege access to the range extender's web management interface sends a crafted request to the AP_get_wireless_clientlist_setClientsName function with an overlong clientsname_0 argument, overflowing a stack buffer in mod_form.so. This corrupts the stack to crash the device or achieve code execution as the web server process. A public proof-of-concept documenting the overflow is already available on GitHub.