PT-2025-23503 · Linksys · Linksys Re6250+5

Pjqwudi · Published 2025-06-02 · Updated 2025-06-25 · CVE-2025-5442

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001

Description A critical issue has been found, affecting the function RP pingGatewayByBBS of the file /goform/RP pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely.

Recommendations For versions 1.0.013.001 through 1.2.07.001, as a temporary workaround, consider disabling the RP pingGatewayByBBS function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-5442

Affected Products

Linksys Re6250

Linksys Re6300

Linksys Re6350

Linksys Ea6500

Linksys Re7000

Linksys Re9000

References · 13

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5442 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5442 · Vendor Advisory
• https://twitter.com/CVEnew/status/1929496853386539090 · Twitter Post
• https://t.me/cvetracker/25164 · Telegram Post
• https://vuldb.com/?id.310781 · Note
• https://vuldb.com/?submit.584364 · Note
• https://t.me/cvenotify/126663 · Telegram Post
• https://vuldb.com/?ctiid.310781 · Note
• https://t.me/cvenotify/124372 · Telegram Post
• https://twitter.com/dailycve/status/1937953807985504586 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1929507015069458563 · Twitter Post
• https://linksys.com · Note