CVE-2025-9250: Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setPWDbyBBS stack-based overflow
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts the function setPWDbyBBS of the file /goform/setPWDbyBBS. Such manipulation of the argument hint leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9250?
CVE-2025-9250 has a high severity score due to its potential for stack-based buffer overflow vulnerabilities.
How do I fix CVE-2025-9250?
To fix CVE-2025-9250, users should update their Linksys devices to the latest firmware version that addresses this vulnerability.
What devices are affected by CVE-2025-9250?
CVE-2025-9250 affects the Linksys models RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000.
What is the nature of the vulnerability in CVE-2025-9250?
CVE-2025-9250 is a stack-based buffer overflow vulnerability that can be exploited through the setPWDbyBBS function in the device's firmware.
Is CVE-2025-9250 being actively exploited?
As of now, there are no confirmed reports of active exploitation related to CVE-2025-9250, but it poses a significant risk.