{"id":"CVE-2025-9527","state":"PUBLISHED","title":"Linksys E1700 QoSSetup stack-based overflow","description":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function QoSSetup of the file /goform/QoSSetup. Performing manipulation of the argument ack_policy results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-08-27T13:02:06.341Z","updatedAt":"2025-08-27T13:28:00.394Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Linksys E1700"],"affected":[{"vendor":"Linksys","product":"E1700","versions":[{"version":"1.0.0.4.003","status":"affected"}]}],"references":["https://vuldb.com/?id.321544","https://vuldb.com/?ctiid.321544","https://vuldb.com/?submit.634826","https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md","https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md#poc","https://www.linksys.com/"],"weaknesses":["CWE-121","CWE-119"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9527.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9527","state":"PUBLISHED","datePublished":"2025-08-27T13:02:06.341Z","dateUpdated":"2025-08-27T13:28:00.394Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-27T05:43:13.651Z"},"containers":{"cna":{"title":"Linksys E1700 QoSSetup stack-based overflow","descriptions":[{"lang":"en","value":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function QoSSetup of the file /goform/QoSSetup. Performing manipulation of the argument ack_policy results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine Schwachstelle wurde in Linksys E1700 1.0.0.4.003 gefunden. Es geht um die Funktion QoSSetup der Datei /goform/QoSSetup. Mittels Manipulieren des Arguments ack_policy mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden."}],"affected":[{"vendor":"Linksys","product":"E1700","versions":[{"version":"1.0.0.4.003","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.321544","name":"VDB-321544 | Linksys E1700 QoSSetup stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321544","name":"VDB-321544 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634826","name":"Submit #634826 | Linksys E1700 E1700(1.0.0.4.003) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md","tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_60/60.md#poc","tags":["exploit"]},{"url":"https://www.linksys.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":9,"vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","type":"CWE","lang":"en","description":"Stack-based Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-08-27T13:02:06.341Z"},"timeline":[{"time":"2025-08-27T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-27T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-27T09:37:01.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Bond_yes (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-27T13:27:51.672873Z","id":"CVE-2025-9527","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-27T13:28:00.394Z"}}]}}}