Ex6150 Firmware CVE-2025-6511

While CVSS 8.8 indicates high severity (Network-accessible, Low complexity, requiring Low privilege escalation), multiple factors amplify real-world risk: (1) Public exploit disclosure eliminates attacker sophistication barriers; (2) Affected device is end-of-life with zero vendor maintenance, ensuring vulnerability persistence in installed base; (3) Authentication requirement (PR:L) is mitigated by common weak default credentials on Netgear devices and lack of credential rotation enforcement; (4) Stack overflow enables direct code execution without relying on secondary vulnerabilities; (5) Legacy WiFi extenders are often forgotten after deployment, reducing monitoring and patching velocity. The CVSS vector indicates high C/I/A impact (complete system compromise). EPSS probability would likely exceed 85% given public POC and end-of-life status. This is a legitimate priority for organizations with EX6150 deployments—not inflated by CVSS inflation. The combination of remote network access, functional POC, and unmaintained hardware creates significant active exploitation risk.

An attacker on the same network (or remotely if device management interface is exposed to internet) authenticates to the EX6150 web management interface using default credentials (commonly admin/password). The attacker crafts a malicious HTTP POST request containing a long string targeting the sub_410090 function, overflowing the stack buffer. The overflow overwrites the function return address with a pointer to attacker-controlled shellcode stored elsewhere on the stack. Upon function return, execution jumps to the shellcode, granting the attacker shell access to the device with root privileges. From this position, the attacker can: (1) exfiltrate WiFi credentials and connected device information; (2) perform man-in-the-middle attacks on client traffic; (3) inject malware into client networks; (4) use the device as a pivot point for lateral movement into corporate networks. Exploitation is straightforward with public POC; no advanced reverse-engineering required. Attack complexity is LOW, and the device's position at network edge makes it an attractive initial compromise vector for advanced threat actors targeting enterprises with legacy IT infrastructure.