Introduction
Attackers can remotely execute arbitrary code on Linksys RE-series range extenders by exploiting a stack-based buffer overflow in the addStaProfile function. The issue affects millions of consumer and small-business wireless networks. There is no patch, and the exploit is public.
Linksys is a major global vendor of networking equipment, especially for residential and small-business markets. Its RE-series range extenders are widely deployed to improve Wi-Fi coverage. The affected models and firmware versions are in broad use, and the vulnerability affects the integrity of any internal network segment where one of these devices is installed.
Technical Information
CVE-2025-9393 is a stack-based buffer overflow in the addStaProfile function, which is reachable through the /goform/addStaProfile HTTP endpoint on affected Linksys RE-series range extenders. An attacker triggers it by sending a crafted HTTP POST request with oversized values in one or more of these parameters:
- profile_name
- Ssid
- wep_key_1
- wep_key_2
- wep_key_3
- wep_key_4
- wep_key_length
- wep_default_key
- cipher
- passphrase
The firmware copies these user-supplied values into fixed-size stack buffers without proper bounds checking. The result is stack memory corruption, which an attacker can use to execute arbitrary code as the web server process. On embedded devices, that process typically runs with high privileges. The vulnerable code path requires no authentication, so an attacker can exploit it remotely.
The root cause is missing input validation and unsafe buffer handling in the firmware. The same pattern shows up in other vulnerabilities in this product line, including CVE-2025-9248, CVE-2025-9253, CVE-2025-9356, CVE-2025-9355, and CVE-2025-9360. Each of them also fails to validate input length before copying data into a stack-allocated buffer.
No patch or official mitigation is available. The exploit is public, and the vulnerability is actively discussed in security research channels.
Affected Systems and Versions
These Linksys RE-series range extender models and firmware versions are affected:
- RE6250 firmware 1.0.013.001
- RE6300 firmware 1.0.04.001
- RE6350 firmware 1.0.04.002
- RE6500 firmware 1.1.05.003
- RE7000 firmware 1.2.07.001
- RE9000 firmware 1.2.07.001
Any configuration that exposes the /goform/addStaProfile endpoint is vulnerable.
Vendor Security History
Linksys has a documented history of stack-based buffer overflows in its RE-series range extenders. Recent CVEs include:
- CVE-2025-9248 (RP_pingGatewayByBBS function, ssidhex parameter)
- CVE-2025-9253 (RP_doSpecifySiteSurvey function, ssidhex parameter)
- CVE-2025-9356 (inboundFilterAdd function)
- CVE-2025-9355 (scheduleAdd function)
- CVE-2025-9360 (accessControlAdd function)
Linksys has not responded to coordinated disclosure attempts for these issues, and it has released no patches or advisories for CVE-2025-9393 or the related vulnerabilities. This indicates systemic weaknesses in how Linksys handles secure development and incident response.
