Executive brief
A security vulnerability exists in the Linksys RE7000 range extender, a device used to expand home or office Wi-Fi coverage. The flaw is located in a component responsible for processing network requests and managing local network address tables. If exploited, a local attacker could cause the device to crash or potentially take full control of the system, leading to a complete loss of service and unauthorized access to the device's operations.
Technical details
A stack-based buffer overflow (CWE-121) exists in the 'arplookup' function within the 'makeRequest.cgi' binary of Linksys RE7000 routers running firmware version FW_v2.0.15_211230_1012. The vulnerability is caused by the unsafe use of 'sscanf' when parsing lines from '/proc/net/arp'. Specifically, the function uses format specifiers '%16s' and '%18s' to populate buffers 'v6' (12 bytes) and 'v7' (20 bytes) respectively. Because the format specifiers allow more data than the destination buffers can hold, an attacker who can control the contents of the ARP table (e.g., via local filesystem write permissions or mount binding) can trigger a buffer overflow. This leads to stack corruption, which can be leveraged for denial of service or arbitrary code execution.
Affected products
- Linksys RE7000 FW_v2.0.15_211230_1012
Timeline
- 2025-11-13: advisory: Initial disclosure date