CVE-2025-6751CWE-119CWE-120

Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflow

High · published June 27, 2025

CVSS v4.0

8.7

EPSS

Percentile

55.6

In the wild

Unconfirmed

What it is

A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS: 0.00784 · 55.6th percentile
Weaknesses: CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published: 2025-06-27T03:00Z

EPSS history

Timeline

27 JUN 03:00Z
Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflow
cvelistv5