CVE-2025-9253 - Vulnerability Details

Description

A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2025-08-20

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linksys

RE6250

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6300

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6350

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6500

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE7000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE9000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6250:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6300:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6350:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re9000:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6500:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Linksys	Re6250	—	—
Linksys	Re6300	—	—
Linksys	Re6350	—	—
Linksys	Re6500	—	—
Linksys	Re7000	—	—
Linksys	Re9000	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-25407	A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00272.

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md
https://vuldb.com/?ctiid.320784
https://vuldb.com/?id.320784
https://vuldb.com/?submit.631526
https://www.linksys.com/

History

Tue, 02 Sep 2025 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware
CPEs		cpe:2.3:h:linksys:re6250:-:::::::* cpe:2.3:h:linksys:re6300:-:::::::* cpe:2.3:h:linksys:re6350:-:::::::* cpe:2.3:h:linksys:re6500:-:::::::* cpe:2.3:h:linksys:re7000:-:::::::* cpe:2.3:h:linksys:re9000:-:::::::* cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:::::::* cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:::::::* cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:::::::* cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:::::::*
Vendors & Products		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware

Thu, 21 Aug 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 21 Aug 2025 12:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000
Vendors & Products		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000

Wed, 20 Aug 2025 22:45:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow
Weaknesses		CWE-119 CWE-121
References		https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md https://vuldb.com/?ctiid.320784 https://vuldb.com/?id.320784 https://vuldb.com/?submit.631526 https://www.linksys.com/
Metrics		cvssV2_0 `{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Linksys Re6250 Re6250 Firmware Re6300 Re6300 Firmware Re6350 Re6350 Firmware Re6500 Re6500 Firmware Re7000 Re7000 Firmware Re9000 Re9000 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-08-20T22:32:06.493Z

Updated: 2025-08-21T14:47:34.751Z

Reserved: 2025-08-20T11:17:03.780Z

Link: CVE-2025-9253

Vulnrichment

Updated: 2025-08-21T13:24:48.435Z

NVD

Status : Analyzed

Published: 2025-08-20T23:15:30.037

Modified: 2025-09-02T18:22:57.450

Link: CVE-2025-9253

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-08-21T12:30:51Z

Weaknesses

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Exploitation poc

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object