Introduction
Remote attackers can gain code execution on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders by exploiting a stack-based buffer overflow in the setWan function. This vulnerability, tracked as CVE-2025-8819, affects devices running firmware up to 20250801 and is remotely exploitable without authentication. Exploit code is publicly available, and there is no vendor patch or official detection guidance as of publication.
Linksys is a widely recognized brand in consumer and small business networking, with millions of deployed devices globally. The RE series range extenders are commonly used to improve wireless coverage in homes and offices, making the real-world impact of this vulnerability substantial.
Technical Information
CVE-2025-8819 is a stack-based buffer overflow that occurs in the setWan function, accessible via the /goform/setWan HTTP endpoint on affected Linksys RE series devices. The vulnerability is triggered when an attacker sends an HTTP POST request with an oversized staticIp parameter. The setWan implementation copies this parameter into a fixed-size stack buffer without proper bounds checking. As a result, the stack can be overwritten, corrupting adjacent memory including return addresses and function pointers. This enables arbitrary code execution with the privileges of the device firmware.
Key technical points:
- The vulnerable endpoint is /goform/setWan
- The attack vector is a crafted HTTP POST with a large staticIp parameter
- No authentication is required to exploit the flaw
- The root cause is lack of input length validation before copying staticIp to a stack buffer
- Exploit code and technical details are publicly available (reference)
No official code snippet is available in the public advisories, but the vulnerability mechanism is confirmed by multiple sources.
Affected Systems and Versions
- Linksys RE6250 (firmware up to 20250801)
- Linksys RE6300 (firmware up to 20250801)
- Linksys RE6350 (firmware up to 20250801)
- Linksys RE6500 (firmware up to 20250801)
- Linksys RE7000 (firmware up to 20250801)
- Linksys RE9000 (firmware up to 20250801)
All configurations with web management interface exposed are vulnerable.
Vendor Security History
Linksys has a recurring pattern of memory safety issues in its embedded firmware. Recent CVEs affecting the same RE series include:
- CVE-2025-8816 (stack-based buffer overflow in setOpMode)
- CVE-2025-8817 (stack-based buffer overflow in setLan)
- CVE-2025-5445, CVE-2025-5447, CVE-2025-5443, CVE-2025-5438 (command injection vulnerabilities)
Vendor response to coordinated disclosure has been poor, with multiple advisories noting lack of response to researcher contact. This raises concerns about the maturity of Linksys's vulnerability management and security development lifecycle.