CVE-2025-9249

Name of the Vulnerable Software and Affected Versions: Linksys RE6250 version 1.0.013.001 Linksys RE6250 version 1.0.04.001 Linksys RE6250 version 1.0.04.002 Linksys RE6250 version 1.1.05.003 Linksys RE6250 version 1.2.07.001 Linksys RE6300 version 1.0.013.001 Linksys RE6300 version 1.0.04.001 Linksys RE6300 version 1.0.04.002 Linksys RE6300 version 1.1.05.003 Linksys RE6300 version 1.2.07.001 Linksys RE6350 version 1.0.013.001 Linksys RE6350 version 1.0.04.001 Linksys RE6350 version 1.0.04.002 Linksys RE6350 version 1.1.05.003 Linksys RE6350 version 1.2.07.001 Linksys RE6500 version 1.0.013.001 Linksys RE6500 version 1.0.04.001 Linksys RE6500 version 1.0.04.002 Linksys RE6500 version 1.1.05.003 Linksys RE6500 version 1.2.07.001 Linksys RE7000 version 1.0.013.001 Linksys RE7000 version 1.0.04.001 Linksys RE7000 version 1.0.04.002 Linksys RE7000 version 1.1.05.003 Linksys RE7000 version 1.2.07.001 Linksys RE9000 version 1.0.013.001 Linksys RE9000 version 1.0.04.001 Linksys RE9000 version 1.0.04.002 Linksys RE9000 version 1.1.05.003 Linksys RE9000 version 1.2.07.001

Description: A stack-based buffer overflow exists in the DHCPReserveAddGroup function within the /goform/DHCPReserveAddGroup file. Manipulation of the enable group, name group, ip group, and mac group arguments can trigger this issue. The attack can be initiated remotely, and an exploit has been publicly disclosed. The vendor was informed of this issue but did not respond.

Recommendations: Linksys RE6250 versions prior to 1.0.013.001 Linksys RE6250 versions prior to 1.0.04.001 Linksys RE6250 versions prior to 1.0.04.002 Linksys RE6250 versions prior to 1.1.05.003 Linksys RE6250 versions prior to 1.2.07.001 Linksys RE6300 versions prior to 1.0.013.001 Linksys RE6300 versions prior to 1.0.04.001 Linksys RE6300 versions prior to 1.0.04.002 Linksys RE6300 versions prior to 1.1.05.003 Linksys RE6300 versions prior to 1.2.07.001 Linksys RE6350 versions prior to 1.0.013.001 Linksys RE6350 versions prior to 1.0.04.001 Linksys RE6350 versions prior to 1.0.04.002 Linksys RE6350 versions prior to 1.1.05.003 Linksys RE6350 versions prior to 1.2.07.001 Linksys RE6500 versions prior to 1.0.013.001 Linksys RE6500 versions prior to 1.0.04.001 Linksys RE6500 versions prior to 1.0.04.002 Linksys RE6500 versions prior to 1.1.05.003 Linksys RE6500 versions prior to 1.2.07.001 Linksys RE7000 versions prior to 1.0.013.001 Linksys RE7000 versions prior to 1.0.04.001 Linksys RE7000 versions prior to 1.0.04.002 Linksys RE7000 versions prior to 1.1.05.003 Linksys RE7000 versions prior to 1.2.07.001 Linksys RE9000 versions prior to 1.0.013.001 Linksys RE9000 versions prior to 1.0.04.001 Linksys RE9000 versions prior to 1.0.04.002 Linksys RE9000 versions prior to 1.1.05.003 Linksys RE9000 versions prior to 1.2.07.001