EUVD-2025-201548Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface
-
DeliveryAuthenticate with valid/weak credentials
-
ExploitSend overlong clientsname_0 to setClientsName
-
ExecutionOverflow stack buffer in mod_form.so
-
PersistHijack control flow / crash service
-
ImpactExecute code on extender
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the device's HTTP management interface and a session at PR:L (authenticated), then invoking the RE2000v2Repeater_get_wired_clientlist_setClientsName function in mod_form.so with an oversized clientsname_0 parameter. Applies to Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 range extenders on the listed firmware builds (1.0.013.001 / 1.0.04.001 / 1.0.04.002 / 1.1.05.003 / 1.2.07.001). Limiting factors: authentication is required (mitigated by strong, non-default admin credentials and restricting management-interface exposure to trusted LAN only); no fixed firmware is available since the vendor did not respond, so mitigation is compensating-control-only. |
| Impact | Signals are mixed and point to a genuine but not high-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) indicates a network-reachable, low-complexity flaw requiring some level of authentication (PR:L) with full confidentiality/integrity/availability impact on the device - consistent with an authenticated stack overflow in the web-management CGI (mod_form.so). A public POC exists (github.com/wudipjq/my_vuln), and the input marks E:P (proof-of-concept exploit maturity), so this is 'publicly available exploit code exists' - NOT confirmed active exploitation. It is NOT in CISA KEV, and EPSS is very low (0.11%, 30th percentile), suggesting no observed mass exploitation and that any activity would be targeted rather than widespread. The PR:L requirement (authenticated web session) is the main brake on real-world risk; a corroborating factor is that the vendor did not respond to disclosure, so no patched firmware is available - an unmitigated but access-gated flaw. Net: a real, exploitable memory-corruption bug on unpatched consumer extenders, but low urgency versus KEV-listed or unauthenticated-RCE issues. |
| Exploit ScenarioDerived | An attacker with access to the device's web management interface (or valid/default credentials) sends a crafted request to the RE2000v2Repeater_get_wired_clientlist_setClientsName handler with an overlong clientsname_0 argument, overflowing a stack buffer in mod_form.so. This corrupts the stack to crash the service or achieve code execution on the extender. A public proof-of-concept is available, lowering the bar to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
A stack-based buffer overflow in the Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 range extenders allows an authenticated remote attacker to corrupt memory and potentially achieve code execution by supplying an oversized clientsname_0 value to the RE2000v2Repeater_get_wired_clientlist_setClientsName function in mod_form.so. Exploitation requires network access to the device's HTTP management interface plus a valid session at PR:L, so devices with default or weak administrator credentials and management interfaces reachable from untrusted networks are the primary exposure. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.11% (30th percentile); no fixed firmware is available because the vendor did not respond to the disclosure, leaving only compensating controls.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch was identified at time of analysis: Linksys was contacted about the disclosure and did not respond, so none of the listed firmware builds (1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001 across RE6250/RE6300/RE6350/RE6500/RE7000/RE9000) has a confirmed fixed version, and no patched release string should be assumed. Until a fix appears, apply compensating controls: change the extender's administrator password from any default value and use a long unique credential, since the vulnerability requires an authenticated session (PR:L) and this directly raises the exploitation bar; and restrict access to the web management interface so it is reachable only from a trusted LAN segment - block WAN-side and guest-network access to the device's HTTP/HTTPS admin ports, and disable any remote-management or cloud-management option if present, accepting that this prevents remote administration of the extender. Segment the extenders onto a dedicated management VLAN with firewall rules permitting only known admin hosts, understanding that this adds operational overhead for legitimate configuration changes. Monitor the Linksys support site (https://www.linksys.com/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14136) for a firmware update, and if a fixed build is published, upgrade all six model families immediately. Because publicly available exploit code exists (see the PoC at https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md#poc and VulDB submission https://vuldb.com/?submit.697983), prioritize inventorying exposed extenders; where a device is end-of-support and cannot be isolated, replacing it is the only durable mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer) inside mod_form.so, a shared form-processing module used by the Linksys RE-series extender firmware. The vulnerable routine, RE2000v2Repeater_get_wired_clientlist_setClientsName, handles the user-supplied client naming feature of the wired client list and copies the clientsname_0 HTTP parameter into a fixed-size stack buffer without adequate bounds checking, allowing an attacker to overwrite adjacent stack memory including saved return addresses. Although the function name references RE2000v2 code, the affected CPE set shows the firmware is shared across the RE6250 (1.0.04.001, 1.0.04.002, 1.0.013.001, 1.1.05.003, 1.2.07.001), RE6300, RE6350, RE6500, RE7000 and RE9000 builds, which is typical of a common firmware codebase rebadged across a product family. The attack surface is the extender's web-based management interface (HTTP), where the parameter is parsed by the vendor's custom module rather than a hardened framework, so no exploit mitigation bypass is needed beyond the buffer overwrite itself. The CVSS 4.0 vector shows PR:L and E:P, matching the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), i.e. remote but authenticated, high confidentiality, integrity and availability impact within the device's own security scope.
Know when Re6250 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web CGI, low complexity, requires an authenticated session (PR:L); stack overflow in device firmware yields full code-execution impact on the host (C/I/A:H), scope unchanged.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical remote code execution vulnerability affecting Linksys range extenders (RE6500, RE6250, RE6300, RE6350, RE7000, RE9000) has been publicly exploited with no vendor patch available. Organizations using these devices face immediate risk of network compromise, unauthorized access, and potential lateral movement into corporate networks.
Segment repeater devices to isolated VLANs with restricted access; disable HTTP/HTTPS management interfaces from untrusted networks using firewall rules; implement network-based IDS/IPS signatures to detect buffer overflow exploitation attempts; restrict administrative access to repeaters through VPN or jump hosts only; consider temporary removal of affected devices until replacement hardware is deployed; monitor device logs for suspicious clientlist modification requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Re6250 Firmware
View allA vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0
Stack-based buffer overflow in the web management service of Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 r
A stack-based buffer overflow in the Linksys RE-series WiFi range extenders (RE6250, RE6300, RE6350, RE6500, RE7000 and
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0
A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE900
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.00
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.0
Exploit-DB