Introduction
Remote attackers can take control of Linksys RE series range extenders by exploiting a stack buffer overflow in the device's web administration interface. The flaw affects a wide range of consumer and small-business Wi-Fi extenders, and it leaves the networks behind them open to code execution and device compromise.
Linksys is a widely known networking hardware vendor with millions of devices deployed in homes and small offices. The RE series extenders are a popular way to expand wireless coverage, so this vulnerability reaches a large user base.
Technical Information
CVE-2025-8817 is a stack-based buffer overflow in the setLan function, which the /goform/setLan endpoint exposes on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices running firmware up to 20250801. An attacker triggers it by sending an oversized lan2enabled argument to that endpoint. The firmware does not properly validate the argument's length before copying it into a stack buffer, which produces a classic stack overflow.
The root cause is insufficient bounds checking on user-supplied data in the setLan handler. The endpoint belongs to the web admin interface, so the attack works remotely if that interface is exposed to the network. Public exploit code shows that the overflow can be used for arbitrary code execution.
As of this writing, the vendor has released no official patch or mitigation. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Affected Systems and Versions
- Linksys RE6250 (firmware up to 20250801)
- Linksys RE6300 (firmware up to 20250801)
- Linksys RE6350 (firmware up to 20250801)
- Linksys RE6500 (firmware up to 20250801)
- Linksys RE7000 (firmware up to 20250801)
- Linksys RE9000 (firmware up to 20250801)
Any configuration that leaves the web admin interface accessible is vulnerable.
Vendor Security History
Linksys networking products have a history of similar vulnerabilities. Recent CVEs include:
- CVE-2025-5443: Critical vulnerability in the same RE series models
- CVE-2025-5439: Command injection in RE series
- CVE-2024-25852: Command injection in RE7000
The vendor has responded inconsistently to coordinated disclosure. In this case, it issued no patch or advisory despite early notification.
