CVE-2025-5447

CVE-2025-5447 is an operating system command injection flaw in the ssid1MACFilter function of the web management interface (/goform/ssid1MACFilter) on several Linksys Wi-Fi range extenders. A remote attacker who can reach the management interface submits crafted values for the apselect_%d and newap_text_%d parameters, which are passed to a shell without adequate sanitization, enabling command execution on the device. The CVSS 4.0 vector indicates low privileges are required (PR:L), so exploitation generally requires access to the management interface, likely with valid login credentials, and the rated impact on confidentiality, integrity and availability is limited. Owners of Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 extenders running the listed firmware versions are affected. A public proof-of-concept has been published (EPSS 32.2%, 98th percentile), there is no confirmed in-the-wild exploitation yet, and the vendor was notified early but did not respond, so no fixed firmware is documented in the available data.

What to do: Check the firmware version on any Linksys RE6500, RE6250, RE6300, RE6350, RE7000 or RE9000 extender and treat the listed builds as vulnerable; because no fixed version is documented, keep the management interface off the internet, restrict access to the web UI (including /goform/ssid1MACFilter) to trusted LAN clients, and use strong admin credentials. Monitor Linksys for a firmware advisory or update and apply it as soon as one becomes available.