PT-2025-34159 · Linksys · Linksys Re6250+5

Pjqwudi · Published 2025-07-15 · Updated 2025-09-02 · CVE-2025-9249

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linksys RE6250 version 1.0.013.001 Linksys RE6250 version 1.0.04.001 Linksys RE6250 version 1.0.04.002 Linksys RE6250 version 1.1.05.003 Linksys RE6250 version 1.2.07.001 Linksys RE6300 version 1.0.013.001 Linksys RE6300 version 1.0.04.001 Linksys RE6300 version 1.0.04.002 Linksys RE6300 version 1.1.05.003 Linksys RE6300 version 1.2.07.001 Linksys RE6350 version 1.0.013.001 Linksys RE6350 version 1.0.04.001 Linksys RE6350 version 1.0.04.002 Linksys RE6350 version 1.1.05.003 Linksys RE6350 version 1.2.07.001 Linksys RE6500 version 1.0.013.001 Linksys RE6500 version 1.0.04.001 Linksys RE6500 version 1.0.04.002 Linksys RE6500 version 1.1.05.003 Linksys RE6500 version 1.2.07.001 Linksys RE7000 version 1.0.013.001 Linksys RE7000 version 1.0.04.001 Linksys RE7000 version 1.0.04.002 Linksys RE7000 version 1.1.05.003 Linksys RE7000 version 1.2.07.001 Linksys RE9000 version 1.0.013.001 Linksys RE9000 version 1.0.04.001 Linksys RE9000 version 1.0.04.002 Linksys RE9000 version 1.1.05.003 Linksys RE9000 version 1.2.07.001

Description: A stack-based buffer overflow exists in the DHCPReserveAddGroup function within the /goform/DHCPReserveAddGroup file. Manipulation of the enable group, name group, ip group, and mac group arguments can trigger this issue. The attack can be initiated remotely, and an exploit has been publicly disclosed. The vendor was informed of this issue but did not respond.

Recommendations: Linksys RE6250 versions prior to 1.0.013.001 Linksys RE6250 versions prior to 1.0.04.001 Linksys RE6250 versions prior to 1.0.04.002 Linksys RE6250 versions prior to 1.1.05.003 Linksys RE6250 versions prior to 1.2.07.001 Linksys RE6300 versions prior to 1.0.013.001 Linksys RE6300 versions prior to 1.0.04.001 Linksys RE6300 versions prior to 1.0.04.002 Linksys RE6300 versions prior to 1.1.05.003 Linksys RE6300 versions prior to 1.2.07.001 Linksys RE6350 versions prior to 1.0.013.001 Linksys RE6350 versions prior to 1.0.04.001 Linksys RE6350 versions prior to 1.0.04.002 Linksys RE6350 versions prior to 1.1.05.003 Linksys RE6350 versions prior to 1.2.07.001 Linksys RE6500 versions prior to 1.0.013.001 Linksys RE6500 versions prior to 1.0.04.001 Linksys RE6500 versions prior to 1.0.04.002 Linksys RE6500 versions prior to 1.1.05.003 Linksys RE6500 versions prior to 1.2.07.001 Linksys RE7000 versions prior to 1.0.013.001 Linksys RE7000 versions prior to 1.0.04.001 Linksys RE7000 versions prior to 1.0.04.002 Linksys RE7000 versions prior to 1.1.05.003 Linksys RE7000 versions prior to 1.2.07.001 Linksys RE9000 versions prior to 1.0.013.001 Linksys RE9000 versions prior to 1.0.04.001 Linksys RE9000 versions prior to 1.0.04.002 Linksys RE9000 versions prior to 1.1.05.003 Linksys RE9000 versions prior to 1.2.07.001

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-15464

CVE-2025-9249

Affected Products

Linksys Re6250

Linksys Re6300

Linksys Re6350

Linksys Ea6500

Linksys Re7000

Linksys Re9000

References · 12

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2025-9249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9249 · Security Note
• https://bdu.fstec.ru/vul/2025-15464 · Security Note
• https://twitter.com/CVEnew/status/1958397789634732264 · Twitter Post
• https://t.me/CVEtracker/30531 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1958289303676629437 · Twitter Post
• https://vuldb.com/?submit.631522 · Note
• https://t.me/cveNotify/134129 · Telegram Post
• https://vuldb.com/?ctiid.320780 · Note
• https://vuldb.com/?id.320780 · Note
• https://linksys.com · Note