CVE-2025-14136 - Vulnerability Details

- Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow

Description

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2025-12-06

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linksys

RE6500

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6250

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6300

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6350

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE7000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE9000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6250:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6300:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6350:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re9000:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Linksys	Re6250	—	—
Linksys	Re6300	—	—
Linksys	Re6350	—	—
Linksys	Re6500	—	—
Linksys	Re7000	—	—
Linksys	Re9000	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00145.

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md
https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md#poc
https://vuldb.com/?ctiid.334525
https://vuldb.com/?id.334525
https://vuldb.com/?submit.697983
https://www.linksys.com/

History

Wed, 10 Dec 2025 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware
Weaknesses		CWE-787
CPEs		cpe:2.3:h:linksys:re6250:-:::::::* cpe:2.3:h:linksys:re6300:-:::::::* cpe:2.3:h:linksys:re6350:-:::::::* cpe:2.3:h:linksys:re6500:-:::::::* cpe:2.3:h:linksys:re7000:-:::::::* cpe:2.3:h:linksys:re9000:-:::::::* cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:::::::* cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:::::::* cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:::::::* cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:::::::*
Vendors & Products		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware

Tue, 09 Dec 2025 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000
Vendors & Products		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000

Mon, 08 Dec 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 06 Dec 2025 13:15:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 mod_form.so stack-based overflow
Weaknesses		CWE-119 CWE-121
References		https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_65/65.md#poc https://vuldb.com/?ctiid.334525 https://vuldb.com/?id.334525 https://vuldb.com/?submit.697983 https://www.linksys.com/
Metrics		cvssV2_0 `{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Linksys Re6250 Re6250 Firmware Re6300 Re6300 Firmware Re6350 Re6350 Firmware Re6500 Re6500 Firmware Re7000 Re7000 Firmware Re9000 Re9000 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-12-06T13:02:05.987Z

Updated: 2025-12-08T19:43:57.853Z

Reserved: 2025-12-05T17:07:21.569Z

Link: CVE-2025-14136

Vulnrichment

Updated: 2025-12-08T19:43:55.006Z

NVD

Status : Analyzed

Published: 2025-12-06T13:15:59.820

Modified: 2025-12-10T18:00:03.980

Link: CVE-2025-14136

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-12-08T09:39:22Z

Weaknesses

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Exploitation poc

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object