TI-2025-08385 Aliases CVE-2025-9146 GHSA-9j2h-mcj7-4233

Linksys E5600 Firmware checkFw.sh verify_gemtek_header risky encryption

HIGH 68CWE-310Published 2025-08-19 · Updated 2025-08-19

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00553 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linksys	E5600	1.1.0.26	—	No fix listed	CNA

E5600 VendorLinksys Affected 1.1.0.26 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:linksys:e5600_firmware:1.1.0.26:::::::*	1.1.0.26	Vulnerable	Linksys
cpe:2.3:h:linksys:e5600:-:::::::*	not specified by NVD	Running on	Linksys

cpe:2.3:o:linksys:e5600_firmware:1.1.0.26:*:*:*:*:*:*:* Versions 1.1.0.26 Vulnerable ·Linksys
cpe:2.3:h:linksys:e5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linksys

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-9146
2026-10-03 Alias added: GHSA-9j2h-mcj7-4233

References

Exploit 1

https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Linksys/E5600.md

Other 1

https://www.linksys.com/

TI-2025-28791 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2025-28790 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2025-28789 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2025-28788 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2025-28787 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8
TI-2025-21022 linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. CVSS 3.1CRITICAL 9.8

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences