Introduction
Remote attackers can take over Linksys RE series range extenders by exploiting a stack-based buffer overflow in the device's web interface. CVE-2025-8822 affects six popular consumer and SMB WiFi extender models, requires no authentication, and puts networks at risk of code execution.
Linksys is a major brand in the global consumer and SMB networking market, with millions of devices deployed. Homes and offices use RE series range extenders to expand wireless coverage, and the devices often run for years without updates or active management.
Technical Information
CVE-2025-8822 is a stack-based buffer overflow in the algDisable function of the /goform/setOpMode endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices with firmware up to 20250801.
A remote attacker triggers it by sending an HTTP POST request to /goform/setOpMode with an opMode parameter longer than the stack buffer that algDisable allocates. The function copies the opMode value into that fixed-size buffer without proper bounds checking. The attacker can then overwrite adjacent stack memory, including the saved return address, and potentially redirect execution to attacker-controlled code.
The endpoint requires no authentication, so any device reachable on the network (or the internet, if exposed) is vulnerable. The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Exploit code is public, which raises the risk of automated exploitation and of the flaw being added to botnets or malware campaigns.
Affected Systems and Versions
- Linksys RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
- All firmware versions up to and including 20250801
- Devices with the web management interface accessible from untrusted networks are at highest risk
Vendor Security History
Linksys has a history of critical vulnerabilities in its networking products, especially in the RE series. Recent CVEs include:
- CVE-2025-8816 and CVE-2025-8817: Stack-based buffer overflows in similar endpoints
- CVE-2025-5438, CVE-2025-5441, CVE-2025-5442, CVE-2025-5443, CVE-2025-5445, CVE-2025-5446, CVE-2025-5447: Command injection vulnerabilities in the same device family
- CVE-2025-34037: OS command injection in E-Series routers, exploited by TheMoon botnet
Linksys has not responded to disclosure attempts for CVE-2025-8822, and no patch is available as of publication.
