Introduction
Remote attackers can take full control of Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders by exploiting a stack-based buffer overflow in the wireless configuration interface. The flaw is tracked as CVE-2025-8820. It affects devices running firmware up to 20250801, and public exploit code is available. Any environment that relies on these devices for wireless coverage should treat it as a high priority.
Linksys is a leading manufacturer of consumer and small-business networking hardware, with millions of users worldwide. Its range extenders are widely deployed in homes and small offices, so vulnerabilities in these devices have a particularly large impact across the industry.
Technical Information
CVE-2025-8820 is a stack-based buffer overflow in the wirelessBasic function of the /goform/wirelessBasic endpoint. An attacker triggers it by sending an HTTP request with an oversized value for the submit_SSID1 parameter. The device firmware copies this value into a fixed-size stack buffer without validating its length. The attacker can then overwrite adjacent stack memory, including the function's return address, and run arbitrary code with the privileges of the device firmware.
Key technical points:
- The vulnerable code path is in the wirelessBasic function, reachable through /goform/wirelessBasic.
- The firmware does not properly bounds-check the submit_SSID1 parameter before copying it into a stack buffer.
- The flaw can be exploited remotely and does not require authentication.
- The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
- Public exploit code is available, which lowers the barrier to exploitation.
Public sources do not include any code from the device firmware. The mechanism is consistent with other stack-based buffer overflows in embedded web interfaces, where the firmware uses unsafe string-copy operations (such as strcpy) without proper length validation.
Affected Systems and Versions
The following Linksys range extender models and firmware versions are affected:
- RE6250 (firmware up to 20250801)
- RE6300 (firmware up to 20250801)
- RE6350 (firmware up to 20250801)
- RE6500 (firmware up to 20250801)
- RE7000 (firmware up to 20250801)
- RE9000 (firmware up to 20250801)
Every configuration with an accessible web management interface is vulnerable.
Vendor Security History
Linksys range extenders have had multiple critical vulnerabilities in 2025, including:
- CVE-2025-8816 (stack-based buffer overflow in the setOpMode function)
- CVE-2025-5445 (OS command injection in RP_checkFWByBBS)
- CVE-2025-5443, CVE-2025-5447, CVE-2025-5438 (other critical memory-safety issues)
Reports indicate that Linksys has not responded to coordinated disclosure efforts for these vulnerabilities, and that no patches had been released as of the disclosure date. That record raises concerns about the vendor's security maturity and responsiveness.
