PT-2025-23512 · Linksys · Linksys Re6250+5

Pjqwudi · Published 2025-05-25 · Updated 2025-06-25 · CVE-2025-5446

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksys RE6500 version 1.0.013.001 Linksys RE6250 version 1.0.013.001 Linksys RE6300 version 1.0.013.001 Linksys RE6350 version 1.0.013.001 Linksys RE7000 version 1.0.013.001 Linksys RE9000 version 1.0.013.001 Linksys RE6500 version 1.0.04.001 Linksys RE6250 version 1.0.04.001 Linksys RE6300 version 1.0.04.001 Linksys RE6350 version 1.0.04.001 Linksys RE7000 version 1.0.04.001 Linksys RE9000 version 1.0.04.001 Linksys RE6500 version 1.0.04.002 Linksys RE6250 version 1.0.04.002 Linksys RE6300 version 1.0.04.002 Linksys RE6350 version 1.0.04.002 Linksys RE7000 version 1.0.04.002 Linksys RE9000 version 1.0.04.002 Linksys RE6500 version 1.1.05.003 Linksys RE6250 version 1.1.05.003 Linksys RE6300 version 1.1.05.003 Linksys RE6350 version 1.1.05.003 Linksys RE7000 version 1.1.05.003 Linksys RE9000 version 1.1.05.003 Linksys RE6500 version 1.2.07.001 Linksys RE6250 version 1.2.07.001 Linksys RE6300 version 1.2.07.001 Linksys RE6350 version 1.2.07.001 Linksys RE7000 version 1.2.07.001 Linksys RE9000 version 1.2.07.001

Description A critical issue has been found in Linksys RE-Series Wireless Range Extenders. This issue affects the function RP checkCredentialsByBBS of the file /goform/RP checkCredentialsByBBS. The manipulation of the argument pwd leads to os command injection. It is possible to initiate the attack remotely.

Recommendations As a temporary workaround, consider disabling the RP checkCredentialsByBBS function until a patch is available. Restrict access to the /goform/RP checkCredentialsByBBS endpoint to minimize the risk of exploitation. Avoid using the argument pwd in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-06491

CVE-2025-5446

Affected Products

Linksys Re6250

Linksys Re6300

Linksys Re6350

Linksys Ea6500

Linksys Re7000

Linksys Re9000

References · 13

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_9/9.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5446 · Security Note
• https://bdu.fstec.ru/vul/2025-06491 · Security Note
• https://t.me/cvenotify/126658 · Telegram Post
• https://twitter.com/SecAideInfo/status/1930569411930280051 · Twitter Post
• https://vuldb.com/?submit.584368 · Note
• https://twitter.com/dailycve/status/1937945495416057993 · Twitter Post
• https://t.me/cvetracker/25178 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1929568445953089880 · Twitter Post
• https://vuldb.com/?ctiid.310785 · Note
• https://vuldb.com/?id.310785 · Note
• https://linksys.com · Note