Introduction
Remote attackers can take control of Linksys RE series range extenders by exploiting a stack buffer overflow in the device's web administration interface. This vulnerability affects a wide range of consumer and small business Wi-Fi extenders, exposing networks to code execution and device compromise.
Linksys is a globally recognized networking hardware vendor, with millions of devices deployed in homes and small offices. The RE series extenders are popular for expanding wireless coverage, making this vulnerability significant for a large user base.
Technical Information
CVE-2025-8817 is a stack-based buffer overflow in the setLan function, accessible via the /goform/setLan endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices running firmware up to 20250801. The vulnerability is triggered by sending an oversized lan2enabled argument to this endpoint. The device firmware does not properly validate the length of this argument before copying it to a stack buffer, resulting in a classic stack overflow condition.
The root cause is insufficient bounds checking on user-supplied data in the setLan handler. Because the vulnerable endpoint is part of the web admin interface, the attack can be performed remotely if the interface is exposed to the network. Public exploit code demonstrates that arbitrary code execution is possible by leveraging this overflow.
No official patch or mitigation from the vendor is available as of this writing. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Affected Systems and Versions
- Linksys RE6250 (firmware up to 20250801)
- Linksys RE6300 (firmware up to 20250801)
- Linksys RE6350 (firmware up to 20250801)
- Linksys RE6500 (firmware up to 20250801)
- Linksys RE7000 (firmware up to 20250801)
- Linksys RE9000 (firmware up to 20250801)
All configurations with the web admin interface accessible are vulnerable.
Vendor Security History
Linksys has a history of similar vulnerabilities affecting its networking products. Recent CVEs include:
- CVE-2025-5443: Critical vulnerability in the same RE series models
- CVE-2025-5439: Command injection in RE series
- CVE-2024-25852: Command injection in RE7000
Vendor response to coordinated disclosure has been inconsistent, and in this case, no patch or advisory was issued despite early notification.