Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 OS Command Injection Vulnerability

A command injection vulnerability has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers, all running firmware released prior to August 1, 2025. The vulnerability resides in the 'RP_setBasic' function of the '/goform/RP_setBasic' file, where the 'bssid' argument can be manipulated to inject and execute arbitrary operating system commands. This issue can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/RP_setBasic' with a crafted 'bssid' parameter that includes the desired command, such as a command to start a reverse shell. After the command is injected, trigger the vulnerability by sending a POST request to '/goform/setCrossBand'.