CVE-2025-5442

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Linksys	RE6500	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
Linksys	RE6250	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
Linksys	RE6300	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
Linksys	RE6350	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
Linksys	RE7000	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
Linksys	RE9000	1.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001

References

https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.310781Permissions Required, VDB Entry
https://vuldb.com/?id.310781Third Party Advisory, VDB Entry
https://vuldb.com/?submit.584364Third Party Advisory, VDB Entry
https://www.linksys.com/Product
https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.mdExploit, Third Party Advisory

Timeline

Published: Jun 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-544215.4NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC CVE-2025-544225.5Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a cr CVE-2025-544236.1copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitra CVE-2025-544249.81Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 CVE-2025-544255.3Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can CVE-2025-544269.9Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519 CVE-2025-544276.9Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inher CVE-2025-544289.8RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versi CVE-2025-544296.9Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier CVE-2025-54439.8A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04 CVE-2025-544309.1dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured d CVE-2025-544337.2Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.