CVE-2025-9483
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-09-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linksys | re6500_firmware | 1.0.013.001 |
| linksys | re6500 | * |
| linksys | re6250_firmware | 1.0.04.001 |
| linksys | re6250 | * |
| linksys | re6300_firmware | 1.2.07.001 |
| linksys | re6300 | * |
| linksys | re6350_firmware | 1.0.04.001 |
| linksys | re6350 | * |
| linksys | re7000_firmware | 1.1.05.003 |
| linksys | re7000 | * |
| linksys | re9000_firmware | 1.0.04.002 |
| linksys | re9000 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9483 is a critical stack-based buffer overflow vulnerability in multiple Linksys range extender models (RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000) affecting specific firmware versions. It occurs in the singlePortForwardAdd function due to improper handling of input parameters ruleName, schedule, and inboundFilter. When these inputs exceed expected lengths, they overflow a buffer on the stack, potentially allowing remote attackers to crash the device or execute arbitrary code without authentication. [1, 2]
How can this vulnerability impact me? :
This vulnerability can compromise the confidentiality, integrity, and availability of the affected Linksys devices. An attacker can remotely exploit the buffer overflow to crash the device or execute arbitrary code, potentially taking full control of the device. Since the exploit is publicly available and no patches or mitigations are provided by the vendor, affected devices are at high risk of being compromised. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual or malformed HTTP requests targeting the /goform/singlePortForwardAdd endpoint, especially those containing unusually long or crafted parameters ruleName, schedule, or inboundFilter that may trigger the stack-based buffer overflow. Since a proof-of-concept exploit is publicly available, network intrusion detection systems (NIDS) can be configured to detect exploit attempts by matching these specific request patterns. Specific commands are not provided in the resources, but using tools like curl or wget to send crafted requests to /goform/singlePortForwardAdd and monitoring device logs for crashes or abnormal behavior can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of the affected Linksys range extender models or replacing them with alternative products, as no patches or vendor mitigations are currently available. It is recommended to restrict remote access to the devices, especially blocking access to the /goform/singlePortForwardAdd endpoint, and monitor network traffic for exploit attempts. Since the vendor has not responded or provided fixes, network-level protections such as firewalls or intrusion prevention systems should be employed to block malicious requests targeting this vulnerability. [1]