CVE-2025-6751
Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflow
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 27, 2025
- Updated
- Jun 27, 2025
- Reserved
- Jun 26, 2025
Description
A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
E8450Linksys |
|
References
- VDB-314049 | Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflowvdb-entrytechnical-description
- VDB-314049 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #598217 | Linksys Holdings, Inc. E8450 <=Ver. 1.2.00.360516 Buffer Overflowthird-party-advisory
- https://github.com/CH13hh/tmp_store_cc/blob/main/E8450/1.mdrelated
- https://github.com/CH13hh/tmp_store_cc/blob/main/E8450/1.md#pocexploit
- https://www.linksys.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.