Linksys RE6250 CVE-2026-114576

Exploitation requires network reachability to the RE6250 Web Management Interface and the ability to predict a session_id value that the server compares with strcmp; the root cause is session identifiers generated with insufficient entropy (CWE-330). No authentication is required (PR:N), but exploitation is materially LIMITED by high attack complexity (AC:H) - the attacker must successfully predict or reconstruct a non-random session token, which the CVE itself describes as 'rather high' complexity and 'difficult.' Impact is confined to confidentiality of session-scoped data on this specific firmware (1.0.04.001); there is no integrity or availability impact. Realistic risk is further bounded by the consumer-extender deployment context, where the management interface is not typically internet-exposed by default.

This is a medium-severity issue (CVSS 4.0 base 6.3) whose signals are internally consistent and point to limited real-world priority. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a network-reachable, unauthenticated weakness but with HIGH attack complexity, and the description explicitly reinforces this: 'The complexity of an attack is rather high' and 'the exploitability is difficult.' The only impact is low confidentiality (VC:L; VI:N/VA:N), matching the CWE-330 insufficiently-random-values root cause - predictable session_id tokens enable session-related information disclosure, not code execution or integrity loss. Public exploit code exists (GitHub PoC referenced), and the CVSS carries E:P (Proof-of-Concept), so this is credible but not weaponized. There is NO CISA KEV listing and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted. Net assessment: a genuine but low-urgency flaw - the high complexity, confidentiality-only impact, and consumer-device target make it a far lower priority than its medium CVSS might suggest. The record was authored by VulDB (a researcher aggregator), not the vendor, so affected-version confirmation is single-sourced.

A remote attacker on a network path to a Linksys RE6250's Web Management Interface observes or collects session_id values and, exploiting their insufficient randomness, predicts or reconstructs a valid session token that the server validates via strcmp. A public proof-of-concept exists, but the attack is rated difficult/high-complexity, so successful prediction likely requires favorable conditions or repeated attempts before the attacker can access session-scoped management data.