Introduction
Remote attackers can take control of Linksys RE series range extenders by exploiting a stack-based buffer overflow in their web management interface. The flaw affects a wide range of consumer and small business deployments, and as of this writing the vendor has released no patch or official remediation.
Linksys is a globally recognized networking hardware vendor with millions of devices in homes and offices. The RE series range extenders, built to extend wireless coverage in homes and small businesses, are among its most popular products. Its firmware has come under repeated scrutiny for memory corruption and command injection vulnerabilities, particularly in recent years.
Technical Information
CVE-2025-8826 is a stack-based buffer overflow in the um_rp_autochannel function, exposed through the /goform/RP_setBasicAuto endpoint on Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders running firmware up to 20250801.
An attacker triggers the overflow by sending an HTTP POST request with an overly long value for either the apcli_AuthMode_2G or apcli_AuthMode_5G parameter. The function copies these parameters into a fixed-size stack buffer without proper bounds checking. If the value is longer than the buffer, it overwrites adjacent stack memory, which may include the function's return address. With a correctly crafted payload, that can lead to remote code execution.
The endpoint is reachable through the device's web management interface, and exploitation requires no authentication. The vulnerability falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
No patch or official workaround is available. The vendor has not responded to disclosure attempts.
Affected Systems and Versions
- Linksys RE6250 (firmware up to 20250801)
- Linksys RE6300 (firmware up to 20250801)
- Linksys RE6350 (firmware up to 20250801)
- Linksys RE6500 (firmware up to 20250801)
- Linksys RE7000 (firmware up to 20250801)
- Linksys RE9000 (firmware up to 20250801)
Every configuration running the vulnerable firmware is affected. The flaw is present in the default configuration, so no special setup is needed to expose it.
Vendor Security History
Linksys has a documented history of memory corruption and command injection vulnerabilities in its firmware, especially in the RE series. Recent disclosures include:
- CVE-2025-8816: Stack-based buffer overflow in setOpMode
- CVE-2025-8817: Stack-based buffer overflow in setLan
- CVE-2025-5442: OS command injection in RP_pingGatewayByBBS
- CVE-2025-5445: OS command injection in RP_checkFWByBBS
- CVE-2025-5446: OS command injection in RP_checkCredentialsByBBS
Multiple advisories for these issues note that Linksys has not responded to coordinated disclosure attempts, and that patches are often delayed or never released.
