CVE-2025-5442: Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RPpingGatewayByBBS of the file /goform/RPpingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5442?
CVE-2025-5442 is classified as a critical vulnerability.
How do I fix CVE-2025-5442?
To fix CVE-2025-5442, update the firmware of your affected Linksys device to the latest version.
Which products are affected by CVE-2025-5442?
CVE-2025-5442 affects Linksys models RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000.
What type of vulnerability is CVE-2025-5442?
CVE-2025-5442 involves a vulnerability in the function RP_pingGatewayByBBS within the /goform/RP_pingGatewayByBBS file.
Is CVE-2025-5442 remotely exploitable?
Yes, CVE-2025-5442 is considered to be remotely exploitable, posing a risk to affected devices.