Introduction
A stack-based buffer overflow in the web management interface of Linksys range extenders lets attackers compromise the devices remotely, in home and business networks alike. The flaw is tracked as CVE-2025-8824. It affects several widely deployed models and allows arbitrary code execution without authentication, which puts network integrity and user data at risk.
Linksys is a major brand in consumer and small business networking, with millions of devices deployed globally. Homes and offices use its RE series range extenders to extend wireless coverage. Because these products are so common and sit inside network infrastructure, a security issue in them has broad impact.
Technical information
CVE-2025-8824 is a stack-based buffer overflow in the setRIP function of the /goform/setRIP endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices running firmware up to 20250801. An attacker triggers it by sending an HTTP request to /goform/setRIP with a crafted value for either the RIPmode or RIPpasswd parameter. The firmware does not validate the length of these parameters before it copies them into a fixed-size stack buffer.
An attacker can use this to overflow the buffer and overwrite adjacent stack memory, including control data such as return addresses. The vulnerable endpoint does not require authentication, so anyone with network access to the device's web interface can perform the attack remotely. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Exploit code for this vulnerability has been published, so a wide range of attackers can use it. The flaw is present in all firmware versions up to and including 20250801 for the affected models. No patch is available at this time, and the vendor has not responded to disclosure attempts.
Affected systems and versions
- Linksys RE6250 (firmware up to and including 20250801)
- Linksys RE6300 (firmware up to and including 20250801)
- Linksys RE6350 (firmware up to and including 20250801)
- Linksys RE6500 (firmware up to and including 20250801)
- Linksys RE7000 (firmware up to and including 20250801)
- Linksys RE9000 (firmware up to and including 20250801)
Every configuration that exposes the /goform/setRIP endpoint is vulnerable.
Vendor security history
Linksys has a documented history of similar vulnerabilities in its networking products, including multiple buffer overflows and command injection flaws. CVE-2025-8816, for example, is a stack-based buffer overflow in the setOpMode function on the same device models. The vendor has been criticized for slow or absent responses to coordinated vulnerability disclosures. For CVE-2025-8824, Linksys did not respond to early disclosure attempts and has not released a patch as of the publication date. Earlier vulnerabilities such as CVE-2025-5445 and CVE-2025-5446 followed the same pattern.
