🔐 CVE Alert

CVE-2025-34037

UNKNOWN 0.0

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

CWE CWE-78
Vendor linksys
Product e4200
Published Jun 24, 2025
Last Updated Apr 7, 2026
Stay Ahead of the Next One

Get instant alerts for linksys e4200

Be the first to know when new unknown vulnerabilities affecting linksys e4200 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Linksys / E4200
0 < 1.0.06
Linksys / E3200
0 < 1.0.05
Linksys / E3000
0 < 1.0.06
Linksys / E2500 v1/v2
0 < 2.0.00
Linksys / E2100L v1
0 ≤ 1.0.05
Linksys / E2000
0
Linksys / E1550
0 ≤ 1.0.03
Linksys / E1500 v1
0 < 1.0.06
Linksys / E1200 v1
0 ≤ 1.0.04
Linksys / E1000 v1
0 < 2.1.03
Linksys / E900 v1
0 < 1.0.04

References

NVD ↗ CVE.org ↗ EPSS Data ↗
isc.sans.edu: https://isc.sans.edu/diary/17633 exploit-db.com: https://www.exploit-db.com/exploits/31683 vulncheck.com: https://vulncheck.com/advisories/linksys-routers-command-injection

Credits

Johannes Ullrich of SANS Internet Storm Center