CVE-2025-5438: Linksys RE9000 Firmware RCE Vulnerability

CVE-2025-5438 Overview

CVE-2025-5438 is a command injection vulnerability [CWE-74] affecting multiple Linksys range extender models, including the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000. The flaw resides in the WPS function within the /goform/WPS endpoint. Attackers can manipulate the PIN argument to inject operating system commands that the device executes. The attack is launched remotely over the network and requires only low-privilege access. The vendor was contacted prior to disclosure but did not respond, and the exploit details have been publicly disclosed.

Critical Impact
Remote attackers can inject arbitrary commands through the WPS PIN parameter, potentially compromising the integrity, confidentiality, and availability of affected Linksys range extenders.

Affected Products

Linksys RE6250 firmware 1.0.04.001, RE6300 firmware 1.2.07.001, RE6350 firmware 1.0.04.001
Linksys RE6500 firmware 1.0.013.001, RE7000 firmware 1.1.05.003
Linksys RE9000 firmware 1.0.04.002

Discovery Timeline

2025-06-02 - CVE-2025-5438 published to NVD
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2025-5438

Vulnerability Analysis

The vulnerability exists in the WPS handler function exposed through the /goform/WPS HTTP endpoint on affected Linksys range extenders. The handler accepts a PIN parameter that is used during Wi-Fi Protected Setup negotiation. The firmware passes the user-supplied PIN value into a system command without proper sanitization or input validation. Attackers can append shell metacharacters to the PIN value to break out of the intended command context and execute arbitrary operating system commands.

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Because the affected endpoint typically runs with elevated privileges on embedded routers, successful injection grants attackers control over the underlying Linux operating system on the device. The EPSS probability of 29.84% places this issue in the 97.96 percentile of likelihood for near-term exploitation.

Root Cause

The WPS function in /goform/WPS concatenates the attacker-controlled PIN argument into a shell command string without escaping or whitelisting allowed characters. Range extender firmware typically invokes helper utilities through system() or similar functions, which interpret shell metacharacters such as ;, |, &, and backticks. Lack of input neutralization allows arbitrary command execution as the web server process.

Attack Vector

An attacker reaches the vulnerable endpoint over the network with low privileges. The attacker sends a crafted HTTP request to /goform/WPS containing a malicious PIN parameter that includes shell metacharacters and arbitrary commands. The device executes the injected commands within the privilege context of the web management daemon. Public disclosure of exploit details on third-party platforms increases the practical risk of weaponization. See the GitHub vulnerability documentation and VulDB entry #310777 for technical specifics.

No verified exploit code is reproduced here. Refer to the public references for the request structure and proof-of-concept payload format.

Detection Methods for CVE-2025-5438

Indicators of Compromise

HTTP POST requests to /goform/WPS containing shell metacharacters (;, |, &, `, $()) in the PIN parameter value.
Outbound connections from range extender management interfaces to unknown external hosts, indicating possible reverse shell or payload retrieval.
Unexpected processes, cron jobs, or modified startup scripts on the device file system.
Web server log entries showing PIN values that do not match the expected eight-digit WPS PIN format.

Detection Strategies

Inspect HTTP traffic to range extender management interfaces for malformed PIN parameters in requests targeting /goform/WPS.
Deploy network intrusion detection signatures matching command injection payloads against the WPS endpoint.
Monitor for anomalous DNS queries or outbound traffic originating from IoT and range extender subnets.

Monitoring Recommendations

Segment range extenders into isolated VLANs and log all administrative traffic to a central SIEM for correlation.
Track firmware version inventory across deployed Linksys devices and alert on unauthorized configuration changes.
Enable alerting on first-seen outbound connections from devices that historically communicate only with internal infrastructure.

How to Mitigate CVE-2025-5438

Immediate Actions Required

Restrict access to the device management interface to trusted internal networks and disable remote administration over WAN.
Disable the WPS feature on affected range extenders if not actively required for device pairing.
Replace end-of-life Linksys range extenders with supported hardware if no firmware update is released by the vendor.

Patch Information

Linksys had not published a security advisory or firmware update at the time of disclosure. The reporting party documented that the vendor did not respond to the disclosure attempt. Monitor the Linksys official website for firmware updates addressing CVE-2025-5438. Until a vendor patch is released, treat affected devices as unpatchable and apply compensating network controls.

Workarounds

Block external access to TCP ports used by the device web administration interface at the perimeter firewall.
Disable Wi-Fi Protected Setup (WPS) functionality through the device administration UI to remove the vulnerable code path from active use.
Place range extenders behind a network segment that enforces egress filtering, limiting the impact of successful command injection.
Rotate Wi-Fi credentials and administrative passwords on any device suspected of exposure.

bash

# Example perimeter firewall rule to restrict management access
iptables -A FORWARD -p tcp -d <range_extender_ip> --dport 80 -s <trusted_admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <range_extender_ip> --dport 80 -j DROP