Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers with firmware released prior to August 1, 2025. The vulnerability arises in the 'langSwitchBack' function of the '/goform/langSwitchBack' file, where the 'langSelectionOnly' argument is not properly validated. This oversight allows remote attackers to send overly long data, causing a stack overflow that could be exploited to execute arbitrary code. The issue has been publicly disclosed, and an exploit is available.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, allowing for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/langSwitchBack' with a 'langSelectionOnly' parameter containing a payload that exceeds the buffer's capacity. This causes the router to crash, disrupting its normal service.