Introduction
Remote attackers can gain full control over Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders by exploiting a stack-based buffer overflow in the setSysAdm function. The flaw is present in multiple firmware versions and a public exploit is available, which puts any network running these devices at significant risk.
Linksys is a major networking hardware vendor with a global presence in consumer and small-business markets. The RE series is widely deployed for wireless range extension in homes and offices. This product line has had a run of critical vulnerabilities, including multiple buffer overflows reported in 2025 alone, and Linksys has a pattern of not responding to coordinated disclosure.
Technical Information
CVE-2025-9358 is a stack-based buffer overflow in the setSysAdm function of the Linksys RE series web management interface. An attacker triggers it by sending an HTTP POST request to the /goform/setSysAdm endpoint with an admpasshint parameter larger than the destination stack buffer. The firmware copies the admpasshint value into a fixed-size buffer without proper bounds checking. Remote, unauthenticated attackers can therefore overwrite stack memory, including the function's return address, and that can lead to arbitrary code execution as root.
The root cause is that the setSysAdm function does not validate the length of the user-supplied admpasshint parameter before copying it into a stack buffer. It is a classic stack-based buffer overflow (CWE-121, CWE-119), and it resembles other recent flaws in Linksys RE firmware where multiple endpoints fail to enforce input size limits.
No public source includes a code snippet for this vulnerability.
Affected Systems and Versions
The following Linksys range extenders and firmware versions are affected:
- RE6250: 1.0.013.001
- RE6300: 1.0.04.001
- RE6350: 1.0.04.002
- RE6500: 1.1.05.003
- RE7000: 1.2.07.001
- RE9000: 1.2.07.001
Every listed version is vulnerable in its default configuration, because the web management interface is enabled by default.
Vendor Security History
Linksys has a documented history of stack-based buffer overflows in the RE series. Multiple CVEs were reported in 2025 for similar flaws in different firmware functions. Linksys has not responded to coordinated disclosure attempts for these issues and has not released patches or advisories. That record indicates systemic problems in the company's secure development and vulnerability management processes.
