EUVD-2025-201546Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to extender web UI
-
DeliverySend oversized clientsname_0 to AP_get_wireless_clientlist_setClientsName
-
ExploitOverflow stack buffer in mod_form.so
-
ExecutionHijack control flow / crash
-
ImpactExecute code or deny service on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's HTTP management interface and the ability to invoke the AP_get_wireless_clientlist_setClientsName handler in mod_form.so with a manipulated clientsname_0 parameter. The CVSS vector (PR:L) indicates low-privilege authentication to the web interface is needed, which limits fully anonymous exploitation; there is no user-interaction requirement (UI:N) and complexity is low (AC:L). Practical risk is bounded by exposure of the extender's management interface - typically LAN-facing rather than WAN-facing - and by the absence of any vendor patch, since the vendor did not respond to disclosure. Affected firmware: RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 at versions 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, and 1.2.07.001. |
| Impact | This is a stack-based buffer overflow (CWE-119) in the mod_form.so CGI handler of several Linksys RE-series WiFi range extenders. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring low-level authentication and yielding high confidentiality, integrity and availability impact on the device - consistent with memory-corruption leading to code execution or crash on an embedded MIPS/ARM appliance. Countervailing signals temper the raw score: EPSS is very low at 0.11% (30th percentile), the vulnerability is NOT on the CISA KEV list, and the CVSS carries E:P (Proof-of-Concept exploit maturity) rather than active exploitation. A public POC does exist (wudipjq/my_vuln GitHub write-up), so exploitability is demonstrated, but publicly available exploit code is a distinct signal from active exploitation - there is no evidence of the latter. The realistic priority is moderate: a working POC against consumer/SOHO range extenders whose vendor did not respond to disclosure (no patch), offset by low EPSS, no KEV, and the PR:L authentication gate. Note a metadata tension: NVD/CVSS assigns CWE-119 (general buffer overflow) while the description specifies a stack-based overflow, better modeled as CWE-121 - a refinement, not a contradiction. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the range extender's web management interface sends a crafted request to the AP_get_wireless_clientlist_setClientsName function with an overlong clientsname_0 argument, overflowing a stack buffer in mod_form.so. This corrupts the stack to crash the device or achieve code execution as the web server process. A public proof-of-concept documenting the overflow is already available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
A stack-based buffer overflow in the Linksys RE-series WiFi range extenders (RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 running firmware 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003 or 1.2.07.001) allows a remote attacker to corrupt memory in the device's web management service, with high impact to confidentiality, integrity and availability. The flaw resides in the AP_get_wireless_clientlist_setClientsName handler inside mod_form.so, where the clientsname_0 argument is copied without bounds checking; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) exploitation requires low-privilege authentication to the HTTP management interface, and no user interaction is needed. Publicly available exploit code exists and was published alongside the disclosure, though EPSS assigns only a 0.11% (30th percentile) probability of exploitation in the next 30 days; the vendor was contacted but never responded, so no official fix has been identified.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch has been identified at time of analysis: Linksys was contacted early but did not respond, and no fixed firmware version appears in the VULDB record (https://vuldb.com/?id.334522), the CPE data, or the EUVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14133). Until a fix ships, treat the extenders as untrusted devices on the network. First, ensure the HTTP management interface is never reachable from the WAN and is confined to a trusted management VLAN or a firewall-restricted source range - this blocks remote (AV:N) exploitation entirely, at the cost of losing convenient remote administration. Second, replace the default administrator password with a strong, unique credential and disable any guest or secondary accounts, since the assessed PR:L vector depends on an attacker holding web-interface credentials; note this only raises the bar and does not mitigate an authenticated insider. Third, disable remote management and UPnP/port-forwarding features that could expose the web UI, and monitor the device's syslog or HTTP access logs for requests containing unusually long clientsname_0 values, which is the signature of the published PoC at https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_62/62.md. Where the extenders are not essential, decommission or replace them with supported hardware; where they remain in service, segment them so a compromise yields only a foothold in the isolated management segment rather than the production LAN. Re-check https://www.linksys.com/ and VULDB periodically for a firmware update, as absence of a patch today does not mean one will never be released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-119) in mod_form.so, a shared library that backs CGI handlers on Linksys RE-series range extenders. The affected function, AP_get_wireless_clientlist_setClientsName, takes a user-supplied HTTP parameter named clientsname_0 and copies it into a fixed-size stack buffer without validating its length. Because the handler is reachable through the device's embedded web management interface, an attacker who can send crafted HTTP requests to that interface can overwrite adjacent stack memory, potentially redirecting execution flow or crashing the management daemon. The CPE data confirms the vulnerable component ships as firmware across the RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 hardware lines at builds 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003 and 1.2.07.001, and EUVD records cross-combinations of those models and builds. The CVSS 4.0 vector supplied by the reporter rates the flaw 7.4 with PR:L and E:P, matching our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: the attacker needs network reachability to the management interface and valid low-privilege credentials, but no user interaction and no elevated privileges. The buffer-overflow class here is memory-unsafe C in a long-lived embedded component, which historically makes reliable control-flow hijacking feasible on MIPS-based consumer routers when ASLR and stack canaries are weak or absent.
Know when Re6250 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web handler (AV:N/AC:L), low-privilege auth to management UI (PR:L), no user interaction; stack overflow enabling code execution gives full C/I/A:H on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of the file mod_form.so. Performing manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical remote code execution vulnerability affects multiple Linksys range extender models with no vendor patch available. Exploitation requires no authentication and could allow attackers to gain complete control of affected devices on your network, potentially compromising connected systems and data.
Network segmentation: isolate range extenders on separate VLAN with restricted egress; disable remote management features if accessible; implement Web Application Firewall (WAF) rules to detect stack buffer overflow attack patterns targeting the mod_form.so endpoint; monitor for unusual outbound connections from extender IP addresses; consider disabling the wireless client list feature if not operationally required; disable UPnP if enabled; replace affected devices with patched alternatives from other vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Re6250 Firmware
View allA vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0
A stack-based buffer overflow in the Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 range extenders allows an
Stack-based buffer overflow in the web management service of Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 r
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0
A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE900
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.00
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.0
Exploit-DB