{"id":"CVE-2025-9249","state":"PUBLISHED","title":"Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow","description":"A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-08-20T21:02:08.236Z","updatedAt":"2025-08-21T14:48:24.205Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Linksys RE6250","Linksys RE6300","Linksys RE6350","Linksys RE6500","Linksys RE7000","Linksys RE9000"],"affected":[{"vendor":"Linksys","product":"RE6250","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6300","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6350","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6500","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE7000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE9000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]}],"references":["https://vuldb.com/?id.320780","https://vuldb.com/?ctiid.320780","https://vuldb.com/?submit.631522","https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md","https://www.linksys.com/"],"weaknesses":["CWE-121","CWE-119"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9249.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9249","state":"PUBLISHED","datePublished":"2025-08-20T21:02:08.236Z","dateUpdated":"2025-08-21T14:48:24.205Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-20T11:16:53.274Z"},"containers":{"cna":{"title":"Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow","descriptions":[{"lang":"en","value":"A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine Schwachstelle wurde in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 gefunden. Dies betrifft die Funktion DHCPReserveAddGroup der Datei /goform/DHCPReserveAddGroup. Die Veränderung des Parameters enable_group/name_group/ip_group/mac_group resultiert in stack-based buffer overflow. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Linksys","product":"RE6250","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6300","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6350","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6500","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE7000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE9000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.320780","name":"VDB-320780 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320780","name":"VDB-320780 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631522","name":"Submit #631522 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001)  RE6250(1.0.04.001)  RE6300(1.2.07.001)  RE6350(1.0.04.001)  RE7000(1.1.05.003)  RE9000(1.0.04.002) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md","tags":["exploit"]},{"url":"https://www.linksys.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":9,"vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","type":"CWE","lang":"en","description":"Stack-based Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-08-20T21:02:08.236Z"},"timeline":[{"time":"2025-08-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-20T13:22:16.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"pjqwudi (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-21T14:39:40.429601Z","id":"CVE-2025-9249","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-21T14:48:24.205Z"}}]}}}