CVE-2024-25852

Published: Apr 11, 2024Modified: Jun 17, 2025

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights.

Affected (3)

Products: Linksys: Re7000 Firmware

Linksys

1 product

Re7000 Firmware

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Linksys Re7000 Firmware	Version 2.0.11
Linksys Re7000 Firmware	Version 2.0.15
Linksys Re7000 Firmware	Version 2.0.9

Running on/with	Platform Versions
Linksys Re7000	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://github.com/ZackSecurity/VulnerReport/blob/cve/Linksys/1.md

Source: cve@mitre.org

Exploit

https://immense-mirror-b42.notion.site/Linksys-RE7000-command-injection-vulnerability-c1a47abf5e8d4dd0934d20d77da930bd

Source: cve@mitre.org

Broken Link

https://github.com/ZackSecurity/VulnerReport/blob/cve/Linksys/1.md

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://immense-mirror-b42.notion.site/Linksys-RE7000-command-injection-vulnerability-c1a47abf5e8d4dd0934d20d77da930bd

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.