CVE-2025-5447

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argument apselect_%d/newap_text_%d leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-544708.6This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled,CVE-2025-544716.5NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret CVE-2025-544727.5Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the sCVE-2025-544739.2An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows codeCVE-2025-544748.5A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrCVE-2025-544758.7A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commCVE-2025-544764.8Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-544775.3Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.CVE-2025-544785.3Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticaCVE-2025-544797.5When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the TraffiCVE-2025-544809.8A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchCVE-2025-544819.8A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch