Introduction
A stack-based buffer overflow in Linksys RE series range extenders lets remote attackers execute code on millions of consumer and small-business networks. The flaw is in the singlePortForwardAdd function, which the device exposes through its web interface, and an attacker can trigger it without authentication. It fits a larger pattern of systemic memory safety failures in Linksys firmware, with over a dozen similar issues reported in 2025 alone.
Technical information
CVE-2025-9483 is a stack-based buffer overflow in the singlePortForwardAdd function of Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders. An attacker triggers it by sending an HTTP POST request to the /goform/singlePortForwardAdd endpoint with oversized values in the ruleName, schedule, or inboundFilter parameters. The firmware copies these parameters into fixed-size stack buffers without proper bounds checking, so a remote attacker can overwrite stack memory and potentially execute arbitrary code. The attack needs no authentication. Any device with network access to the range extender's administrative interface can carry it out.
The root cause is missing input validation and bounds checking on user-supplied POST parameters. When a request carries excessively long values for ruleName, schedule, or inboundFilter, the firmware's unsafe copy operation produces a classic stack-based buffer overflow. The overflow can overwrite return addresses or function pointers on the stack and redirect execution to attacker-controlled code. The vulnerability is present in multiple firmware versions and matches other buffer overflow issues in the same product line, such as those in the /goform/qosClassifier, /goform/portTriggerManageRule, and /goform/addStaProfile endpoints.
The affected firmware has no modern memory protections such as stack canaries or ASLR, which makes exploitation more reliable. Public exploit code is available, which lowers the technical bar for attackers.
Affected systems and versions
- Linksys RE6250, RE6300, RE6350, RE6500, RE7000, RE9000
- Firmware versions: 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
- Vulnerable when the administrative interface is accessible on the network
Vendor security history
Linksys RE series range extenders have had a run of similar stack-based buffer overflows during 2025, including:
- CVE-2025-9392 (qosClassifier function)
- CVE-2025-9363 (portTriggerManageRule function)
- CVE-2025-9248 (RP_pingGatewayByBBS function)
- CVE-2025-9355 (scheduleAdd function)
- CVE-2025-9356 (inboundFilterAdd function)
- CVE-2025-9393 (addStaProfile function)
All of them share the same root cause: missing input validation and unsafe memory handling in /goform/ endpoints. The vendor has not responded to coordinated disclosure attempts and has released no patches or advisories for these issues. That record points to systemic problems in secure development and vulnerability management.
