CVE-2025-5447 is a medium severity (CVSS 6.3) OS command injection in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 range extenders. The ssid1MACFilter handler at /goform/ssid1MACFilter passes input to a system command. The record lists no vendor fix, so isolate the devices.
What's affected
- Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 are affected.
- Firmware versions named in the record are 1.0.013.001, 1.0.04.001, 1.0.04.002, 1.1.05.003 and 1.2.07.001.
- No fixed firmware is recorded. The record says the vendor was contacted early and did not respond.
- This is one of several similar command injection reports against the same device family and the same /goform/ handler style.
The record lists CVSS 6.3 (Medium). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Log in to the extender's admin page and read the model and firmware version. Compare them with the list above.
Then check from a neighbouring device whether the admin interface answers on your network. If you cannot tell, treat it as reachable.
What to do now
- Inventory every Linksys RE series extender at home, in branch offices and in lab networks.
- Check the Linksys support site for any firmware newer than the versions listed above.
- Block access to the admin interface from guest and untrusted networks.
- Do not expose the admin interface to the internet.
- Replace devices that are end of life or that never receive a fix.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record tags the flaw as CWE-78 and CWE-77: the the apselect and newap_text fields input is used in a command without being neutralised. It requires low privileges and low complexity over the network, hence the CVSS 6.3.
The record states the exploit has been disclosed publicly. It is not on the CISA KEV list. Embedded devices rarely get automatic updates, so network placement is your main control.
Severity scores are a starting point. The score for this entry is 6.3, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is there a patch?
The record lists none and says the vendor did not respond. Check the Linksys support page for your model.
What is the best interim control?
Limit who can reach the admin interface, and keep the device off networks you do not trust.
Sources
- https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_10/10.md
- https://vuldb.com/?ctiid.310786
- https://vuldb.com/?id.310786
- https://vuldb.com/?submit.584369
- https://www.linksys.com/
Last reviewed: 18 October 2026.
