CVE-2025-5446 Overview
CVE-2025-5446 is an operating system command injection vulnerability affecting multiple Linksys range extender models. The flaw resides in the RP_checkCredentialsByBBS function exposed through the /goform/RP_checkCredentialsByBBS endpoint. Attackers can inject arbitrary shell commands through the pwd parameter, leading to unauthenticated remote command execution on the device. The vulnerability is classified under [CWE-77] and [CWE-78]. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts. Affected models include the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 range extenders.
Critical Impact
Successful exploitation grants attackers arbitrary command execution on the underlying Linux firmware, enabling full device compromise, traffic interception, and pivot points into the connected network.
Affected Products
- Linksys RE6250 firmware 1.0.04.001 and RE6350 firmware 1.0.04.001
- Linksys RE6300 firmware 1.2.07.001 and RE6500 firmware 1.0.013.001
- Linksys RE7000 firmware 1.1.05.003 and RE9000 firmware 1.0.04.002
Discovery Timeline
- 2025-06-02 - CVE-2025-5446 published to NVD
- 2025-06-25 - Last updated in NVD database
Technical Details for CVE-2025-5446
Vulnerability Analysis
The vulnerability resides in the web management interface of the affected Linksys range extenders. The RP_checkCredentialsByBBS handler processes HTTP requests sent to /goform/RP_checkCredentialsByBBS. The handler reads the pwd parameter from the request and passes it to a shell command without sanitization or escaping.
Because the input is concatenated into an operating system command, an attacker can supply shell metacharacters such as ;, |, or backticks to break out of the intended command context. The injected payload executes with the privileges of the web server, which typically runs as root on consumer extender firmware. Public documentation of the vulnerability is available in the GitHub vulnerability writeup and VulDB entry #310785.
Root Cause
The root cause is missing input validation in the RP_checkCredentialsByBBS function. The pwd argument is forwarded to a system shell invocation without neutralizing special elements. This pattern matches [CWE-78] Improper Neutralization of Special Elements used in an OS Command.
Attack Vector
The attack is conducted over the network against the device's HTTP management interface. An attacker crafts a POST request to /goform/RP_checkCredentialsByBBS containing a malicious pwd value with embedded shell metacharacters. The handler then executes the attacker-supplied commands on the device.
No verified exploit code is reproduced here. The vulnerability mechanism is straightforward command concatenation in the pwd argument. See the linked GitHub advisory for proof-of-concept details.
Detection Methods for CVE-2025-5446
Indicators of Compromise
- HTTP requests to /goform/RP_checkCredentialsByBBS containing shell metacharacters such as ;, |, &, $(), or backticks in the pwd parameter.
- Outbound connections from Linksys extenders to unfamiliar IP addresses, particularly to download secondary payloads or establish reverse shells.
- Unexpected processes such as wget, curl, nc, or busybox spawned by the device web server.
Detection Strategies
- Inspect web access logs on perimeter or upstream proxy devices for POST requests targeting /goform/RP_checkCredentialsByBBS.
- Deploy network intrusion detection signatures matching shell metacharacters in HTTP request bodies destined for Linksys management interfaces.
- Monitor DNS queries and HTTP egress from range extender management IP addresses for anomalous destinations.
Monitoring Recommendations
- Centralize logs from network gateways and SIEM platforms to correlate suspicious HTTP traffic to embedded device interfaces.
- Baseline normal management traffic to Linksys extenders and alert on deviations such as POST requests from non-administrative subnets.
- Track device firmware versions and flag any device still running the affected versions identified in this advisory.
How to Mitigate CVE-2025-5446
Immediate Actions Required
- Restrict access to the web management interface to trusted administrative VLANs or hosts using firewall rules.
- Disable remote management features on all affected RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 devices.
- Place affected extenders behind a segmented network where untrusted clients cannot reach the management interface.
Patch Information
Linksys did not respond to the disclosure, and no vendor patch is currently published for the affected firmware versions. Organizations operating these devices should consider replacement with supported hardware that receives security updates. Monitor the Linksys support site for any future firmware releases addressing this issue.
Workarounds
- Block external access to TCP ports hosting the device web interface at the perimeter firewall.
- Apply access control lists that limit management interface connections to known administrator workstations.
- Decommission end-of-support range extender models and replace them with vendor-maintained equipment.
# Example iptables rule restricting management interface access
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.