CVE-2025-9355: Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 scheduleAdd stack-based overflow
A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function scheduleAdd of the file /goform/scheduleAdd. Performing manipulation of the argument ruleName results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What devices are affected by CVE-2025-9355?
CVE-2025-9355 affects Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers.
What is the nature of the vulnerability described in CVE-2025-9355?
CVE-2025-9355 involves a vulnerability in the function scheduleAdd located in the /goform/scheduleAdd file.
How can I mitigate the risk associated with CVE-2025-9355?
To mitigate CVE-2025-9355, it is recommended to update the affected Linksys devices to the latest firmware version.
Is there a workaround for CVE-2025-9355 until a fix is available?
A possible temporary workaround for CVE-2025-9355 is to disable the scheduling functions on the affected devices.
What is the impact of exploitation of CVE-2025-9355?
Exploitation of CVE-2025-9355 could allow an attacker to manipulate the device settings, potentially leading to unauthorized control.