Introduction
Remote attackers can take full control of vulnerable Linksys range extenders through a stack buffer overflow in the device's web interface. The flaw affects several popular models used in homes and small businesses, and it exposes the networks behind them to code execution and persistent compromise.
Linksys is a well-known brand in the consumer and SMB networking market, with millions of devices deployed worldwide. The RE series (RE6250, RE6300, RE6350, RE6500, RE7000, RE9000) is commonly used for wireless range extension and mesh networking in both residential and commercial settings. The security of these devices matters for the integrity of the local networks they serve and for the privacy of the people who use them.
Technical information
CVE-2025-8832 is a stack-based buffer overflow in the setDMZ function of the Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders, affecting firmware up to version 20250801. The flaw is in the HTTP management interface, at the /goform/setDMZ endpoint.
The root cause is insufficient bounds checking on the DMZIPAddress parameter. When a user (or attacker) submits a request to configure the DMZ settings, the firmware copies the value of DMZIPAddress into a fixed-size stack buffer without checking its length. Input longer than the buffer overwrites stack memory, including the function's return address. It is a classic memory corruption bug, and control of the return address lets an attacker redirect execution and run arbitrary code on the device.
An attacker can trigger the overflow remotely, without authentication. Exploit code is publicly available, so attackers can automate scanning and exploitation of exposed devices. The underlying cause is a lack of proper input validation and secure coding practices in the firmware's web interface.
The public sources include no code snippet, but the technical analysis confirms the mechanism and the affected parameter. The flaw is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Affected systems and versions
- Linksys RE6250, firmware up to 20250801
- Linksys RE6300, firmware up to 20250801
- Linksys RE6350, firmware up to 20250801
- Linksys RE6500, firmware up to 20250801
- Linksys RE7000, firmware up to 20250801
- Linksys RE9000, firmware up to 20250801
These devices are vulnerable in their default configuration, because the web management interface and the /goform/setDMZ endpoint are enabled by default.
Vendor security history
Linksys firmware, the RE series in particular, has a recurring history of memory safety issues. Recent CVEs include:
- CVE-2025-8817: Stack buffer overflow in setLan (lan2enabled parameter)
- CVE-2025-8816: Stack buffer overflow in setOpMode
- CVE-2025-8819: Stack buffer overflow in setWan
- Multiple command injection vulnerabilities (CVE-2025-5441, CVE-2025-5442, CVE-2025-5446)
Each of these was disclosed publicly without a timely vendor advisory or patch. Linksys has not responded to coordinated disclosure efforts for CVE-2025-8832 and related issues, and it has released no official mitigations or updates.
