External risk intelligence

RE11S Firmware Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-22907

The vulnerability affects an Edimax RE11S, which is a wireless range extender. These devices are network-accessible consumer appliances typically deployed to bridge or extend local networks. Given their role as edge networking hardware with management interfaces and web-based configuration forms, they are commonly reachable within the network environment where they are deployed.

Buffer Overflow

Edimax Re11s Firmware

1.11

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain Edimax wireless range extender firmware, specifically related to a stack overflow flaw in a web interface function. This issue could allow unauthenticated attackers to remotely impact the device's confidentiality, integrity, and availability by exploiting a weakness in how a specific parameter is handled. The main concern is confirming relevance and exposure.

Flaw in wireless extenders allows remote system compromise.
High severity; impacts device integrity and availability.
Verify if these devices are deployed in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a vulnerability in the RE11S wireless range extender by sending a specially crafted request to its web interface. This request would target the `selSSID` parameter within the `formWlSiteSurvey` function, triggering a stack overflow. This could allow an attacker to gain control of the device, impacting its confidentiality, integrity, and availability.

Accessible via the network without authentication.
Triggered by a malformed `selSSID` parameter.
Leads to critical device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the stability and confidentiality of the wireless range extender's services and potentially compromise the integrity of data handled by the device. When the `selSSID` parameter is improperly processed in the `formWlSiteSurvey` function, a stack overflow condition can occur, which may lead to service disruption or unauthorized information disclosure.

Wireless extender services and data.
Network requests to the device.
Device instability and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Edimax RE11S wireless range extender firmware is affected by a critical stack overflow vulnerability. This issue requires immediate attention from network infrastructure and security teams, as the device is network-accessible and presents a significant risk. The first step is to identify all deployed RE11S devices, determine their network exposure and business criticality, and locate the accountable owner to plan remediation.

Network and security teams own the issue.
Verify device network exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Edimax RE11S?

The Edimax RE11S is a wireless range extender used to expand the coverage area of a Wi-Fi network. It acts as a bridge between your main router and devices in areas with weak signal, managing network traffic through its own internal firmware and web-based configuration interface.

What does a stack overflow mean for CVE-2025-22907?

This vulnerability, classified as CWE-120, means the device's software lacks proper boundaries when processing input. By sending too much data to a specific part of the system, an attacker can force the memory to overflow. In the context of this CVE, this flaw allows the device to process malicious input in a way that can crash the system or potentially allow unauthorized control.

How is this vulnerability triggered?

The flaw is triggered when the device receives a specially crafted network request containing a malformed 'selSSID' parameter within the 'formWlSiteSurvey' function. It is important to note that this requires a network-based interaction with the device's web interface; simply having the device powered on or connected to the internet without such a specific request does not trigger the vulnerability.

Is my device at risk of this vulnerability?

According to Halo Surface Signal, this vulnerability is particularly relevant for wireless range extenders like the RE11S because they are designed to be reachable across network environments. If your device's web configuration interface is accessible over your network, it is potentially reachable by unauthorized requests, making it important to assess its deployment.

What steps should I take if I use an RE11S?

Begin by identifying every RE11S device currently active in your network environment. Once you have a complete inventory, determine which units are accessible over your network. Prioritize finding the designated owner for these devices so you can coordinate with them to manage the risk and prepare for necessary firmware updates or configuration changes.

References

www.edimax.com/edimax/global/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.