CVE-2025-8828

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argument Ipv6PriDns/Ipv6SecDns/Ipv6StaticGateway/LanIpv6Addr/LanPrefixLen/pppoeUser/pppoePass/pppoeIdleTime/pppoeRedialPeriod/Ipv6in4_PrefixLen/LocalIpv6/RemoteIpv4/LanIPv6_Prefix/LanPrefixLen/ipv6to4Relay/ipv6rdRelay/tunrd_PrefixLen/wan_UseLinkLocal/Ipv6StaticIp/Ipv6PrefixLen leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Linksys	RE6250	20250801
Linksys	RE6300	20250801
Linksys	RE6350	20250801
Linksys	RE6500	20250801
Linksys	RE7000	20250801
Linksys	RE9000	20250801

References

https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.319362Permissions Required, VDB Entry
https://vuldb.com/?id.319362Third Party Advisory, VDB Entry
https://vuldb.com/?submit.626693Third Party Advisory, VDB Entry
https://www.linksys.com/Product
https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.md#pocExploit, Third Party Advisory

Timeline

Published: Aug 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-88298.8A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability i CVE-2025-88308.8A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the fu CVE-2025-88318.8A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function remoteManag CVE-2025-88328.8A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the f CVE-2025-88338.8A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function CVE-2025-88342.4A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of t CVE-2025-88355.5A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper CVE-2025-88363.3A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc CVE-2025-88377.8A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the CVE-2025-88389.8A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the functio CVE-2025-88398.8A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the compo CVE-2025-88405.4A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the compone