{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-9393", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-08-23T15:38:12.812Z", "datePublished": "2025-08-24T15:32:06.793Z", "dateUpdated": "2025-08-25T17:20:38.495Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-24T15:32:06.793Z" }, "title": "Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaProfile stack-based overflow", "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "Stack-based Buffer Overflow" } ] }, { "descriptions": [ { "type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption" } ] } ], "affected": [ { "vendor": "Linksys", "product": "RE6250", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] }, { "vendor": "Linksys", "product": "RE6300", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] }, { "vendor": "Linksys", "product": "RE6350", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] }, { "vendor": "Linksys", "product": "RE6500", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] }, { "vendor": "Linksys", "product": "RE7000", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] }, { "vendor": "Linksys", "product": "RE9000", "versions": [ { "version": "1.0.013.001", "status": "affected" }, { "version": "1.0.04.001", "status": "affected" }, { "version": "1.0.04.002", "status": "affected" }, { "version": "1.1.05.003", "status": "affected" }, { "version": "1.2.07.001", "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaProfile of the file /goform/addStaProfile. Performing manipulation of the argument profile_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." }, { "lang": "de", "value": "In Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 wurde eine Schwachstelle gefunden. Es ist betroffen die Funktion addStaProfile der Datei /goform/addStaProfile. Durch Beeinflussen des Arguments profile_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Es ist möglich, den Angriff aus der Ferne durchzuführen. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden." } ], "metrics": [ { "cvssV4_0": { "version": "4.0", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "HIGH" } }, { "cvssV3_1": { "version": "3.1", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH" } }, { "cvssV3_0": { "version": "3.0", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH" } }, { "cvssV2_0": { "version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR" } } ], "timeline": [ { "time": "2025-08-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed" }, { "time": "2025-08-23T02:00:00.000Z", "lang": "en", "value": "VulDB entry created" }, { "time": "2025-08-23T17:43:20.000Z", "lang": "en", "value": "VulDB entry last update" } ], "credits": [ { "lang": "en", "value": "pjq123 (VulDB User)", "type": "reporter" } ], "references": [ { "url": "https://vuldb.com/?id.321226", "name": "VDB-321226 | Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaProfile stack-based overflow", "tags": [ "vdb-entry", "technical-description" ] }, { "url": "https://vuldb.com/?ctiid.321226", "name": "VDB-321226 | CTI Indicators (IOB, IOC, IOA)", "tags": [ "signature", "permissions-required" ] }, { "url": "https://vuldb.com/?submit.631538", "name": "Submit #631538 | Linksys RE6500、RE6250、RE6300、RE6350、RE7000、RE9000 RE6500(1.0.013.001) RE6250(1.0.04.001) RE6300(1.2.07.001) RE6350(1.0.04.001) RE7000(1.1.05.003) RE9000(1.0.04.002) Stack-based Buffer Overflow", "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md", "tags": [ "related" ] }, { "url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md#poc", "tags": [ "exploit" ] }, { "url": "https://www.linksys.com/", "tags": [ "product" ] } ] }, "adp": [ { "references": [ { "url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md#poc", "tags": [ "exploit" ] }, { "url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md", "tags": [ "exploit" ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-08-25T17:20:34.217450Z", "id": "CVE-2025-9393", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-25T17:20:38.495Z" } } ] } }