Linksys RE Extenders CVE-2025-14135

Exploitation targets the AP_get_wired_clientlist_setClientsName function in mod_form.so on Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 range extenders across firmware 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001, by supplying an oversized clientsname_0 argument. The attacker must be able to reach the device's HTTP management interface and, per the CVSS vector, hold low-privilege authenticated access (PR:L) - so exploitation is limited to those who can log into or otherwise reach the admin web service (typically LAN/Wi-Fi adjacent or via an exposed/forwarded management port). No user interaction is required (UI:N), and no non-default feature toggle is described; the main limiting factors are the authentication requirement and the need for network reachability to the management interface. No official patch exists because the vendor did not respond.

Signals are mixed and point to a real-but-niche issue rather than a widespread emergency. The CVSS 4.0 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity stack overflow that requires some level of authentication (PR:L) and yields high confidentiality, integrity and availability impact on the device - consistent with a memory-corruption flaw in an embedded web-management binary. Against that, EPSS is only 0.11% (30th percentile), indicating low modeled probability of broad exploitation despite a publicly available proof-of-concept. There is no CISA KEV listing and no evidence of active exploitation, so 'publicly available exploit code exists' is the accurate exploitation status - this must not be conflated with in-the-wild activity. The CVSS 4.0 vector already embeds E:P (Proof-of-Concept), aligning with the reported POC. A significant aggravating factor is that the vendor was contacted but did not respond, and no patch or fixed firmware version is available, so exposed devices stay vulnerable indefinitely. Net: a genuine RCE-class bug on consumer/SOHO range extenders, but the PR:L requirement, low EPSS, and niche/consumer footprint place it at moderate real-world priority rather than critical - highest concern for internet-exposed or shared-network management interfaces.

An attacker with access to the device's web management interface (e.g., on the local/Wi-Fi network or an exposed admin port) submits a crafted client name via the AP_get_wired_clientlist_setClientsName handler in mod_form.so, setting an overlong clientsname_0 value that overflows a stack buffer. A public proof-of-concept exists (wudipjq/my_vuln GitHub), lowering the effort to reproduce; successful exploitation can crash the device or achieve code execution on the range extender. The CVSS vector's low attack complexity and network vector make triggering the overflow straightforward once the attacker can reach the management endpoint.