CVE-2025-5438

CVE-2025-5438 is a command injection flaw (CWE-74/CWE-77) in the WPS handler of six Linksys Wi-Fi range extenders, where attacker-controlled input to the PIN parameter at /goform/WPS is incorporated into an operating-system command without proper validation. The attack can be launched remotely over the network through the device's management interface. An attacker who reaches the vulnerable endpoint can execute arbitrary commands on the extender; the CVSS 4.0 base score of 5.3 (medium) reflects a network-vector attack with low privileges required and low rated confidentiality, integrity and availability impact, although the disclosing source labels it critical. Owners of Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 running the cited firmware versions are affected, and the vendor was contacted early but did not respond. A public proof-of-concept exploit is available on GitHub, EPSS assigns a 26.1% probability of exploitation within 30 days (98th percentile), but the flaw is not yet in CISA KEV and there are no confirmed in-the-wild attacks.

What to do: Check each extender's current firmware version against the affected versions cited above; because the vendor did not respond to the disclosure, no fixed firmware is documented, so treat all listed versions as vulnerable and monitor Linksys support pages for updated releases. Until a patch is available, disable or restrict remote (WAN-side) management of the extender, keep the admin interface limited to the local network, and consider turning off WPS if the model permits it. Prioritize devices whose management interface is reachable from the internet or from guest/untrusted networks.