PT-2025-35124 · Linksys · Linksys Re6250+5

Bond_Yes · Published 2025-08-28 · Updated 2025-12-27 · CVE-2025-9575

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksys RE6250 version 1.0.013.001 Linksys RE6250 version 1.0.04.001 Linksys RE6250 version 1.0.04.002 Linksys RE6250 version 1.1.05.003 Linksys RE6250 version 1.2.07.001 Linksys RE6300 version 1.0.013.001 Linksys RE6300 version 1.0.04.001 Linksys RE6300 version 1.0.04.002 Linksys RE6300 version 1.1.05.003 Linksys RE6300 version 1.2.07.001 Linksys RE6350 version 1.0.013.001 Linksys RE6350 version 1.0.04.001 Linksys RE6350 version 1.0.04.002 Linksys RE6350 version 1.1.05.003 Linksys RE6350 version 1.2.07.001 Linksys RE6500 version 1.0.013.001 Linksys RE6500 version 1.0.04.001 Linksys RE6500 version 1.0.04.002 Linksys RE6500 version 1.1.05.003 Linksys RE6500 version 1.2.07.001 Linksys RE7000 version 1.0.013.001 Linksys RE7000 version 1.0.04.001 Linksys RE7000 version 1.0.04.002 Linksys RE7000 version 1.1.05.003 Linksys RE7000 version 1.2.07.001 Linksys RE9000 version 1.0.013.001 Linksys RE9000 version 1.0.04.001 Linksys RE9000 version 1.0.04.002 Linksys RE9000 version 1.1.05.003 Linksys RE9000 version 1.2.07.001

Description A vulnerability exists in the cgiMain function of the /cgi-bin/upload.cgi file. Manipulation of the filename argument can lead to operating system command injection. This issue can be exploited remotely. The vulnerability has been publicly disclosed.

Recommendations Linksys RE6250 versions prior to 1.0.013.001 Linksys RE6250 versions prior to 1.0.04.001 Linksys RE6250 versions prior to 1.0.04.002 Linksys RE6250 versions prior to 1.1.05.003 Linksys RE6250 versions prior to 1.2.07.001 Linksys RE6300 versions prior to 1.0.013.001 Linksys RE6300 versions prior to 1.0.04.001 Linksys RE6300 versions prior to 1.0.04.002 Linksys RE6300 versions prior to 1.1.05.003 Linksys RE6300 versions prior to 1.2.07.001 Linksys RE6350 versions prior to 1.0.013.001 Linksys RE6350 versions prior to 1.0.04.001 Linksys RE6350 versions prior to 1.0.04.002 Linksys RE6350 versions prior to 1.1.05.003 Linksys RE6350 versions prior to 1.2.07.001 Linksys RE6500 versions prior to 1.0.013.001 Linksys RE6500 versions prior to 1.0.04.001 Linksys RE6500 versions prior to 1.0.04.002 Linksys RE6500 versions prior to 1.1.05.003 Linksys RE6500 versions prior to 1.2.07.001 Linksys RE7000 versions prior to 1.0.013.001 Linksys RE7000 versions prior to 1.0.04.001 Linksys RE7000 versions prior to 1.0.04.002 Linksys RE7000 versions prior to 1.1.05.003 Linksys RE7000 versions prior to 1.2.07.001 Linksys RE9000 versions prior to 1.0.013.001 Linksys RE9000 versions prior to 1.0.04.001 Linksys RE9000 versions prior to 1.0.04.002 Linksys RE9000 versions prior to 1.1.05.003 Linksys RE9000 versions prior to 1.2.07.001 Consider disabling the /cgi-bin/upload.cgi file to prevent exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-9575

Affected Products

Linksys Re6250

Linksys Re6300

Linksys Re6350

Linksys Ea6500

Linksys Re7000

Linksys Re9000

References · 11

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_13/13.md#poc · Exploit, Deleted
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_13/13.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-9575 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9575 · Vendor Advisory
• https://t.me/CVEtracker/31155 · Telegram Post
• https://vuldb.com/?submit.634840 · Note
• https://vuldb.com/?id.321689 · Note
• https://twitter.com/VulmonFeeds/status/1961167382551883851 · Twitter Post
• https://twitter.com/CVEnew/status/2005031795171995915 · Twitter Post
• https://linksys.com · Note
• https://vuldb.com/?ctiid.321689 · Note