PT-2025-23485 · Linksys · Linksys Re6250+5

Pjqwudi · Published 2025-06-02 · Updated 2025-07-02 · CVE-2025-5438

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksys RE6500 version 1.0.013.001 Linksys RE6250 version 1.0.013.001 Linksys RE6300 version 1.0.013.001 Linksys RE6350 version 1.0.013.001 Linksys RE7000 version 1.0.013.001 Linksys RE9000 version 1.0.013.001 Linksys RE6500 version 1.0.04.001 Linksys RE6500 version 1.0.04.002 Linksys RE6500 version 1.1.05.003 Linksys RE6500 version 1.2.07.001

Description A critical vulnerability was found in the WPS function of the file /goform/WPS, allowing command injection via manipulation of the PIN argument. This issue can be exploited remotely.

Recommendations For Linksys RE6500 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE6250 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE6300 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE6350 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE7000 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE9000 version 1.0.013.001, consider disabling the WPS function until a patch is available. For Linksys RE6500 version 1.0.04.001, consider disabling the WPS function until a patch is available. For Linksys RE6500 version 1.0.04.002, consider disabling the WPS function until a patch is available. For Linksys RE6500 version 1.1.05.003, consider disabling the WPS function until a patch is available. For Linksys RE6500 version 1.2.07.001, consider disabling the WPS function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-5438

Affected Products

Linksys Re6250

Linksys Re6300

Linksys Re6350

Linksys Ea6500

Linksys Re7000

Linksys Re9000

References · 12

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_1/1.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5438 · Security Note
• https://twitter.com/SecAideInfo/status/1930206945975120249 · Twitter Post
• https://t.me/cvetracker/25152 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1929486533142200710 · Twitter Post
• https://vuldb.com/?id.310777 · Note
• https://t.me/cvenotify/127467 · Telegram Post
• https://vuldb.com/?ctiid.310777 · Note
• https://vuldb.com/?submit.584360 · Note
• https://t.me/cvenotify/124318 · Telegram Post
• https://linksys.com · Note