CVE-2025-34037
Description
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
How to fix
- Linksys E42001.0.06 or later
- Linksys E32001.0.05 or later
- Linksys E30001.0.06 or later
- Linksys E2500 v1/v22.0.00 or later
- Linksys E1500 v11.0.06 or later
- Linksys E1000 v12.1.03 or later
- Linksys E900 v11.0.04 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linksys E4200 | v < 1.0.06 | 1.0.06 |
| Linksys E3200 | v < 1.0.05 | 1.0.05 |
| Linksys E3000 | v < 1.0.06 | 1.0.06 |
| Linksys E2500 v1/v2 | v < 2.0.00 | 2.0.00 |
| Linksys E2100L v1 | v ≤ 1.0.05 | — |
| Linksys E2000 | 0 | — |
| Linksys E1550 | v ≤ 1.0.03 | — |
| Linksys E1500 v1 | v < 1.0.06 | 1.0.06 |
| Linksys E1200 v1 | v ≤ 1.0.04 | — |
| Linksys E1000 v1 | v < 2.1.03 | 2.1.03 |
| Linksys E900 v1 | v < 1.0.04 | 1.0.04 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.