CVE-2025-5446 Overview
A critical OS command injection vulnerability has been discovered in multiple Linksys WiFi range extender models. The vulnerability exists in the RP_checkCredentialsByBBS function within the /goform/RP_checkCredentialsByBBS endpoint. By manipulating the pwd argument, an authenticated remote attacker can inject and execute arbitrary operating system commands on the affected device. This vulnerability has been publicly disclosed with exploit details available, and the vendor has not responded to disclosure attempts.
Critical Impact
Remote OS command injection in Linksys range extenders allows authenticated attackers to execute arbitrary commands, potentially leading to complete device compromise, network pivoting, and persistent backdoor installation.
Affected Products
- Linksys RE6500 firmware version 1.0.013.001
- Linksys RE6250 firmware version 1.0.04.001
- Linksys RE6300 firmware version 1.2.07.001
- Linksys RE6350 firmware version 1.0.04.001
- Linksys RE7000 firmware version 1.1.05.003
- Linksys RE9000 firmware version 1.0.04.002
Discovery Timeline
- June 2, 2025 - CVE-2025-5446 published to NVD
- June 25, 2025 - Last updated in NVD database
Technical Details for CVE-2025-5446
Vulnerability Analysis
This vulnerability is classified under CWE-77 (Command Injection) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected function RP_checkCredentialsByBBS in the device firmware fails to properly sanitize user-supplied input in the pwd parameter before incorporating it into operating system commands. This allows an attacker with network access and low-level authentication to inject malicious shell commands that execute with the privileges of the web server process on the embedded device.
The attack can be initiated remotely over the network without any user interaction required. Successful exploitation grants the attacker the ability to read and modify device configurations, intercept network traffic, pivot to other network segments, or establish persistent access to the compromised device.
Root Cause
The root cause of this vulnerability lies in insufficient input validation and sanitization within the RP_checkCredentialsByBBS function. The pwd argument is passed directly to system shell execution functions without proper escaping or filtering of shell metacharacters. This classic command injection pattern occurs when user input is concatenated into command strings that are subsequently executed by the operating system shell.
Attack Vector
The vulnerability is exploitable remotely over the network. An attacker must have low-level authenticated access to the device's web management interface. The attack targets the /goform/RP_checkCredentialsByBBS endpoint, where specially crafted input containing shell metacharacters and commands can be submitted through the pwd parameter. When the server-side code processes this input without proper sanitization, the injected commands are executed in the context of the device's operating system.
The attack flow involves:
- Authenticating to the device's web interface with valid credentials
- Crafting a malicious HTTP request to /goform/RP_checkCredentialsByBBS
- Including OS command injection payloads in the pwd parameter
- The device executes the injected commands with system privileges
For detailed technical analysis of this vulnerability, refer to the GitHub vulnerability documentation.
Detection Methods for CVE-2025-5446
Indicators of Compromise
- Unexpected HTTP POST requests to /goform/RP_checkCredentialsByBBS with special characters or shell metacharacters in the pwd parameter
- Unusual outbound network connections originating from Linksys range extender devices
- Unexpected processes running on the device that are not part of normal firmware operations
- Modified configuration files or new user accounts on affected devices
Detection Strategies
- Monitor network traffic for HTTP requests to /goform/RP_checkCredentialsByBBS containing suspicious payloads such as semicolons, pipes, backticks, or command sequences
- Deploy network-based intrusion detection signatures to identify command injection attempts targeting Linksys devices
- Review web server logs on the device (if accessible) for unusual requests to the vulnerable endpoint
- Implement SentinelOne Singularity to detect and alert on anomalous network behavior from IoT devices
Monitoring Recommendations
- Enable comprehensive logging on network firewalls and IDS/IPS systems for traffic to and from Linksys range extender devices
- Monitor for DNS queries or network connections to suspicious external hosts originating from IoT device IP addresses
- Regularly audit device configurations for unauthorized changes
- Implement network segmentation to isolate IoT devices from critical network resources
How to Mitigate CVE-2025-5446
Immediate Actions Required
- Isolate affected Linksys range extender devices from critical network segments immediately
- Change all administrative credentials on affected devices to strong, unique passwords
- Restrict access to the device management interface to trusted IP addresses only
- Monitor network traffic from affected devices for signs of compromise
- Consider replacing vulnerable devices with alternative products if no patch is available
Patch Information
As of the last update on June 25, 2025, Linksys has not responded to vulnerability disclosure attempts and no official patch is currently available. Users should monitor the Linksys official website for any future security advisories or firmware updates addressing this vulnerability.
Additional information is available from VulDB.
Workarounds
- Disable remote management access to affected devices and allow only local network access
- Implement firewall rules to block external access to the device's web management interface
- Place affected devices behind a network firewall with strict access controls
- Use VPN or network segmentation to limit exposure of the management interface
- Consider disabling the affected functionality if possible until a patch is released
# Example firewall rule to restrict access to Linksys management interface
# Block external access to port 80/443 on Linksys device IP
iptables -A INPUT -p tcp -d <LINKSYS_DEVICE_IP> --dport 80 -s ! <TRUSTED_NETWORK> -j DROP
iptables -A INPUT -p tcp -d <LINKSYS_DEVICE_IP> --dport 443 -s ! <TRUSTED_NETWORK> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
