Introduction
Remote attackers can gain code execution on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders by exploiting a stack-based buffer overflow in the setWan function. The vulnerability is tracked as CVE-2025-8819. It affects devices running firmware up to 20250801 and can be exploited remotely without authentication. Exploit code is public, and as of publication there is no vendor patch or official detection guidance.
Linksys is a well-known consumer and small business networking brand with millions of devices deployed worldwide. Homes and offices commonly use the RE series range extenders to improve wireless coverage, which gives this vulnerability substantial real-world impact.
Technical information
CVE-2025-8819 is a stack-based buffer overflow in the setWan function, which affected Linksys RE series devices expose through the /goform/setWan HTTP endpoint. An attacker triggers it by sending an HTTP POST request with an oversized staticIp parameter. The setWan implementation copies this parameter into a fixed-size stack buffer without proper bounds checking. The copy can overwrite the stack and corrupt adjacent memory, including return addresses and function pointers. That allows arbitrary code execution with the privileges of the device firmware.
Key technical points:
- The vulnerable endpoint is /goform/setWan
- The attack vector is a crafted HTTP POST with a large staticIp parameter
- Exploiting the flaw requires no authentication
- The root cause is missing input length validation before staticIp is copied to a stack buffer
- Exploit code and technical details are public (reference)
The public advisories include no official code snippet, but multiple sources confirm the vulnerability mechanism.
Affected systems and versions
- Linksys RE6250 (firmware up to 20250801)
- Linksys RE6300 (firmware up to 20250801)
- Linksys RE6350 (firmware up to 20250801)
- Linksys RE6500 (firmware up to 20250801)
- Linksys RE7000 (firmware up to 20250801)
- Linksys RE9000 (firmware up to 20250801)
Every configuration that exposes the web management interface is vulnerable.
Vendor security history
Linksys has a recurring pattern of memory safety issues in its embedded firmware. Recent CVEs affecting the same RE series include:
- CVE-2025-8816 (stack-based buffer overflow in setOpMode)
- CVE-2025-8817 (stack-based buffer overflow in setLan)
- CVE-2025-5445, CVE-2025-5447, CVE-2025-5443, CVE-2025-5438 (command injection vulnerabilities)
Linksys has handled coordinated disclosure poorly, and multiple advisories note that researchers who contacted the vendor got no response. That raises concerns about the maturity of Linksys's vulnerability management and security development lifecycle.
