CVE-2025-34037 in the critical feed json
Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
published 2025-06-24 16 mo ago modified 2026-07-22 3 mo ago also EUVD-2025-18964
- cvss
- 10.0
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 96.2%
- EPSS 96.2% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 1
- Metasploit
Summary
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Patch / fix
- Linksys E4200 1.0.06
- Linksys E3200 1.0.05
- Linksys E3000 1.0.06
- Linksys E2500 v1/v2 2.0.00
- Linksys E1500 v1 1.0.06
- Linksys E1000 v1 2.1.03
- Linksys E900 v1 1.0.04
Timeline
- First public exploit (Metasploit exploit/linux/http/linksys_themoon_exec)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 16 mo ago
Exploit prediction
96.15% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/linksys_themoon_exec Linksys E-Series TheMoon Remote Command Injection metasploit exploit, excellent rank, 2014-02-13
- exploit-db.com https://www.exploit-db.com/exploits/31683 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Linksys E4200
- Linksys E3200
- Linksys E3000
- Linksys E2500 v1/v2
- Linksys E2100L v1
- Linksys E2000
- Linksys E1550
- Linksys E1500 v1
- Linksys E1200 v1
- Linksys E1000 v1
- Linksys E900 v1
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
exploit-db.com
/exploits/31683
third-party-advisory, exploit
-
isc.sans.edu
/diary/17633
technical-description
-
vulncheck.com
/advisories/linksys-routers-command-injection
third-party-advisory
- github.com /Jarrettgohxz/CVE-research/tree/main/Linksys/E-series/CVE-2025-34037
Sources
- CVE List CVE-2025-34037
- NVD CVE-2025-34037
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.