{"id":"CVE-2025-9253","state":"PUBLISHED","title":"Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow","description":"A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-08-20T22:32:06.493Z","updatedAt":"2025-08-21T14:47:34.751Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Linksys RE6250","Linksys RE6300","Linksys RE6350","Linksys RE6500","Linksys RE7000","Linksys RE9000"],"affected":[{"vendor":"Linksys","product":"RE6250","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6300","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6350","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6500","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE7000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE9000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]}],"references":["https://vuldb.com/?id.320784","https://vuldb.com/?ctiid.320784","https://vuldb.com/?submit.631526","https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md","https://www.linksys.com/"],"weaknesses":["CWE-121","CWE-119"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9253.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9253","state":"PUBLISHED","datePublished":"2025-08-20T22:32:06.493Z","dateUpdated":"2025-08-21T14:47:34.751Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-20T11:17:03.780Z"},"containers":{"cna":{"title":"Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine Schwachstelle wurde in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 gefunden. Hiervon betroffen ist die Funktion RP_doSpecifySiteSurvey der Datei /goform/RP_doSpecifySiteSurvey. Mit der Manipulation des Arguments ssidhex mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Die Ausnutzung wurde veröffentlicht und kann verwendet werden."}],"affected":[{"vendor":"Linksys","product":"RE6250","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6300","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6350","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE6500","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE7000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]},{"vendor":"Linksys","product":"RE9000","versions":[{"version":"1.0.013.001","status":"affected"},{"version":"1.0.04.001","status":"affected"},{"version":"1.0.04.002","status":"affected"},{"version":"1.1.05.003","status":"affected"},{"version":"1.2.07.001","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.320784","name":"VDB-320784 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320784","name":"VDB-320784 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.631526","name":"Submit #631526 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 Linksys Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md","tags":["exploit"]},{"url":"https://www.linksys.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":9,"vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","type":"CWE","lang":"en","description":"Stack-based Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-08-20T22:32:06.493Z"},"timeline":[{"time":"2025-08-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-20T13:22:21.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"pjqwudi (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-21T13:24:41.746941Z","id":"CVE-2025-9253","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-21T14:47:34.751Z"}}]}}}