Introduction
A critical stack-based buffer overflow lets remote attackers take control of Linksys RE series range extenders, which can lead to network compromise. The flaw affects a broad population of consumer and small-business devices, so anyone who relies on these models for wireless coverage should pay attention.
Linksys is a major global networking hardware vendor, best known for its consumer and small-business routers and range extenders. It has millions of devices deployed worldwide, so a vulnerability in its products directly affects network security in homes and offices.
Technical information
CVE-2025-8816 is a stack-based buffer overflow in the setOpMode function of the /goform/setOpMode endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders running firmware up to 20250801. An attacker triggers it by sending an HTTP request with an oversized ethConv parameter. The function does not properly validate the length of ethConv before it copies the value into a fixed-size stack buffer, so the attacker can overwrite stack memory, including the return address. That can give the attacker arbitrary code execution with the privileges of the device firmware, and the attack works remotely without authentication.
The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). Exploit code has been published, which lowers the barrier to exploitation.
Affected systems and versions
- Linksys RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
- Firmware versions up to and including 20250801
- Devices are vulnerable in default configurations that expose the /goform/setOpMode endpoint
Vendor security history
Linksys has had a series of similar vulnerabilities in recent years, including:
- CVE-2025-8817: Stack-based buffer overflow in the setLan function (/goform/setLan) in the same device models and firmware versions
- CVE-2025-5445, CVE-2025-5447, CVE-2025-5443, CVE-2025-5438: Multiple OS command injection vulnerabilities in related functions
- CVE-2025-34037: OS command injection in E-Series routers, exploited by TheMoon worm
- CVE-2023-46012: Stack-based buffer overflow in EA7500 routers
- CVE-2014-125122: Stack-based buffer overflow in WRT120N
Multiple advisories note that Linksys did not respond to coordinated disclosure, which raises concerns about how the company manages vulnerabilities and responds with patches.
