Overview
A critical security vulnerability, designated as CVE-2025-9253, has been identified in a range of Linksys Wi-Fi range extenders. This issue has been found to affect RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 models with specific firmware versions. The vulnerability resides in the RP_doSpecifySiteSurvey function of the /goform/RP_doSpecifySiteSurvey file. An attacker can exploit this vulnerability and compromise the system or cause data leakage, posing significant risks for users.
The breach is particularly dangerous because the attack can be initiated remotely, and the exploit has been publicly disclosed. Despite being informed about this vulnerability, the vendor has remained silent, leaving the devices exposed to potential attacks.
Vulnerability Summary
CVE ID: CVE-2025-9253
Severity: High (8.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Linksys RE6250 | 1.0.013.001, 1.0.04.001, 1.0.04.002
Linksys RE6300 | 1.0.013.001, 1.0.04.001, 1.0.04.002
Linksys RE6350 | 1.0.013.001, 1.0.04.001, 1.0.04.002
Linksys RE6500 | 1.0.013.001, 1.0.04.001, 1.0.04.002
Linksys RE7000 | 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003
Linksys RE9000 | 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003, 1.2.07.001
How the Exploit Works
The vulnerability stems from the improper handling of the ‘ssidhex’ argument in the function RP_doSpecifySiteSurvey. When an attacker manipulates ‘ssidhex’ and sends an overly long argument, it overflows the stack-based buffer. This overflow can lead to arbitrary code execution, granting the attacker control over the system.
Conceptual Example Code
The following is a conceptual example of how an attacker might exploit the vulnerability. This is not a working exploit but an illustration of the vulnerability:
POST /goform/RP_doSpecifySiteSurvey HTTP/1.1
Host: target_linksys_device_ip
Content-Type: application/x-www-form-urlencoded
ssidhex=41414141...[A*5000]In this example, the ‘ssidhex’ argument is filled with a large number of ‘A’ characters (41 in hexadecimal), causing a buffer overflow.
