CVE-2025-9355

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function scheduleAdd of the file /goform/scheduleAdd. Performing manipulation of the argument ruleName results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-121

Affected software

VendorProductVersions
LinksysRE62501.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
LinksysRE63001.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
LinksysRE63501.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
LinksysRE65001.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
LinksysRE70001.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001
LinksysRE90001.0.013.001; 1.0.04.001; 1.0.04.002; 1.1.05.003; 1.2.07.001

References

Timeline

Published
Aug 22, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-93568.8A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2CVE-2025-93578.8A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2CVE-2025-93588.8A security flaw has been discovered in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.00CVE-2025-93598.8A weakness has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2CVE-2025-93608.8A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.CVE-2025-93618.8A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.0CVE-2025-93628.8A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. CVE-2025-93638.8A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2CVE-2025-93648.8An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This couCVE-2025-93657.8Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which mCVE-2025-93675.5The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, CVE-2025-93688.7A security issue exists within 432ES-IG3 Series A, which affects GuardLink® EtherNet/IP Interface, resulting in denial-of-service. A manual
CVE-2025-9355: High severity, CVSS 8.8 | Vulnix