CVE-2025-5441
Severity CVSS v4.0:
MEDIUM
Type:
CWE-77
Command Injection
Publication date:
02/06/2025
Last modified:
25/06/2025
Description
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The manipulation of the argument DeviceURL leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM
Base Score 3.x
6.30
Severity 3.x
MEDIUM
Base Score 2.0
6.50
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linksys:re9000_firmware:1.0.04.002:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re9000:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linksys:re6250_firmware:1.0.04.001:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re6250:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linksys:re6300_firmware:1.2.07.001:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re6300:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linksys:re6350_firmware:1.0.04.001:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re6350:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linksys:re7000_firmware:1.1.05.003:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linksys:re6500_firmware:1.0.013.001:*:*:*:*:*:*:* | ||
| cpe:2.3:h:linksys:re6500:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



