Paper/Archive/CVE-2025-34037

CVE-2025-34037

Linksys E4200 — Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Affected

ProductAffectedFixed inSource

E4200< 1.0.061.0.06CNA

E3200< 1.0.051.0.05CNA

E3000< 1.0.061.0.06CNA

E2500 v1/v2< 2.0.002.0.00CNA

E2100L v1≤ 1.0.05–CNA

E2000all versions–CNA

E1550≤ 1.0.03–CNA

E1500 v1< 1.0.061.0.06CNA

E1200 v1≤ 1.0.04–CNA

E1000 v1< 2.1.032.1.03CNA

E900 v1< 1.0.041.0.04CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupisc.sans.edu/diary/17633 exploitexploit-db.com/exploits/31683 writeupvulncheck.com/advisories/linksys-routers-command-injection refgithub.com/Jarrettgohxz/CVE-research/tree/main/Linksys/E-series/CVE-2025-34037