CVE-2025-9249

Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow

Published Aug 20, 2025 CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Description

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linksys

RE6250

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6300

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6350

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE6500

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE7000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Linksys

RE9000

affected

Version	Status	Constraints
`1.0.013.001`	affected	—
`1.0.04.001`	affected	—
`1.0.04.002`	affected	—
`1.1.05.003`	affected	—
`1.2.07.001`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6250:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6300:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6350:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re9000:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:*:*:*:*:*:*:*

cpe:2.3:h:linksys:re6500:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Linksys	Re6250	—
Linksys	Re6300	—
Linksys	Re6350	—
Linksys	Re6500	—
Linksys	Re7000	—
Linksys	Re9000	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-25437	A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.077% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md
https://vuldb.com/?ctiid.320780
https://vuldb.com/?id.320780
https://vuldb.com/?submit.631522
https://www.linksys.com/

History

Sep 2, 2025 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware
CPEs		cpe:2.3:h:linksys:re6250:-:::::::* cpe:2.3:h:linksys:re6300:-:::::::* cpe:2.3:h:linksys:re6350:-:::::::* cpe:2.3:h:linksys:re6500:-:::::::* cpe:2.3:h:linksys:re7000:-:::::::* cpe:2.3:h:linksys:re9000:-:::::::* cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:::::::* cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:::::::* cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:::::::* cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:::::::* cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:::::::*
Vendors & Products		Linksys re6250 Firmware Linksys re6300 Firmware Linksys re6350 Firmware Linksys re6500 Firmware Linksys re7000 Firmware Linksys re9000 Firmware

Aug 21, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2025 12:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000
Vendors & Products		Linksys Linksys re6250 Linksys re6300 Linksys re6350 Linksys re6500 Linksys re7000 Linksys re9000

Aug 20, 2025 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow
Weaknesses		CWE-119 CWE-121
References		https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md https://vuldb.com/?ctiid.320780 https://vuldb.com/?id.320780 https://vuldb.com/?submit.631522 https://www.linksys.com/
Metrics		cvssV2_0 `{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Linksys Re6250 Re6250 Firmware Re6300 Re6300 Firmware Re6350 Re6350 Firmware Re6500 Re6500 Firmware Re7000 Re7000 Firmware Re9000 Re9000 Firmware

Weaknesses

Sources

CVE record Updated: Aug 21, 2025, 2:48 PM

Status: PUBLISHED
Assigner: VulDB
Published: Aug 20, 2025, 9:02 PM
Updated: Aug 21, 2025, 2:48 PM
Reserved: Aug 20, 2025, 11:16 AM

View source JSON

Vulnrichment Updated: Aug 21, 2025, 1:26 PM

Updated: Aug 21, 2025, 1:26 PM

JSON

NVD Updated: Jun 17, 2026, 10:08 AM

Status: Analyzed
Published: Aug 20, 2025, 9:15 PM
Modified: Jun 17, 2026, 10:08 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment Updated: Aug 21, 2025, 12:30 PM

Updated: Aug 21, 2025, 12:30 PM

JSON

Affected Products

Remediation

Tracking

Advisories

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Exploitation poc

Automatable no

Technical Impact total

Subscriptions

Sources

JSON object

JSON object

JSON object

JSON object

JSON object