TI-2025-24206 Aliases CVE-2025-34037 GHSA-4c6f-v7q4-2m38

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

CRITICAL 93CWE-78Published 2025-06-24 · Updated 2026-07-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.96154 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed E4200 (Linksys): 1.0.06E3200 (Linksys): 1.0.05+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linksys	E4200	before 1.0.06	1.0.06	Patch available	CNA
Linksys	E3200	before 1.0.05	1.0.05	Patch available	CNA
Linksys	E3000	before 1.0.06	1.0.06	Patch available	CNA
Linksys	E2500 v1/v2	before 2.0.00	2.0.00	Patch available	CNA
Linksys	E2100L v1	up to 1.0.05	—	No fix listed	CNA
Linksys	E2000	all versions	—	No fix listed	CNA
Linksys	E1550	up to 1.0.03	—	No fix listed	CNA
Linksys	E1500 v1	before 1.0.06	1.0.06	Patch available	CNA
Linksys	E1200 v1	up to 1.0.04	—	No fix listed	CNA
Linksys	E1000 v1	before 2.1.03	2.1.03	Patch available	CNA
Linksys	E900 v1	before 1.0.04	1.0.04	Patch available	CNA

E4200 VendorLinksys Affected before 1.0.06 Fixed in 1.0.06 Patch available CNA
E3200 VendorLinksys Affected before 1.0.05 Fixed in 1.0.05 Patch available CNA
E3000 VendorLinksys Affected before 1.0.06 Fixed in 1.0.06 Patch available CNA
E2500 v1/v2 VendorLinksys Affected before 2.0.00 Fixed in 2.0.00 Patch available CNA
E2100L v1 VendorLinksys Affected up to 1.0.05 Fixed in — No fix listed CNA
E2000 VendorLinksys Affected all versions Fixed in — No fix listed CNA
E1550 VendorLinksys Affected up to 1.0.03 Fixed in — No fix listed CNA
E1500 v1 VendorLinksys Affected before 1.0.06 Fixed in 1.0.06 Patch available CNA
E1200 v1 VendorLinksys Affected up to 1.0.04 Fixed in — No fix listed CNA
E1000 v1 VendorLinksys Affected before 2.1.03 Fixed in 2.1.03 Patch available CNA
E900 v1 VendorLinksys Affected before 1.0.04 Fixed in 1.0.04 Patch available CNA

Remediation

Fix · CNA E4200 (Linksys) Fixed in 1.0.06
Fix · CNA E3200 (Linksys) Fixed in 1.0.05
Fix · CNA E3000 (Linksys) Fixed in 1.0.06
Fix · CNA E2500 v1/v2 (Linksys) Fixed in 2.0.00
Fix · CNA E1500 v1 (Linksys) Fixed in 1.0.06
Fix · CNA E1000 v1 (Linksys) Fixed in 2.1.03
Fix · CNA E900 v1 (Linksys) Fixed in 1.0.04

Timeline

2026-10-02 Threatist record created from CVE-2025-34037
2026-10-03 Alias added: GHSA-4c6f-v7q4-2m38

References

Exploit 1

https://www.exploit-db.com/exploits/31683

Other 1

https://isc.sans.edu/diary/17633

TI-2017-12715 OS command injection in Linksys WVBR0 CVSS 3.0CRITICAL 9.8
TI-2026-70977 Stack-based buffer overflow in Linksys E1700 Mac Filter CVSS 4.0CRITICAL 10.0
TI-2026-22199 Missing neutralization in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
TI-2026-22198 Missing neutralization in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
TI-2026-22197 Missing authentication in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
TI-2025-28791 Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8

See all 253 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences