CVE-2025-34037: Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 96.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-24 · updated 2026-07-22
Weakness: CWE-78

Description

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Affected products

Linksys E1000 v1: before 2.1.03 — fixed in 2.1.03
Linksys E1200 v1: through 1.0.04
Linksys E1500 v1: before 1.0.06 — fixed in 1.0.06
Linksys E1550: through 1.0.03
Linksys E2000: 0
Linksys E2100L v1: through 1.0.05
Linksys E2500 v1/v2: before 2.0.00 — fixed in 2.0.00
Linksys E3000: before 1.0.06 — fixed in 1.0.06
Linksys E3200: before 1.0.05 — fixed in 1.0.05
Linksys E4200: before 1.0.06 — fixed in 1.0.06
Linksys E900 v1: before 1.0.04 — fixed in 1.0.04

How to fix

Upgrade to a fixed version: Linksys E1000 v1 2.1.03; Linksys E1500 v1 1.0.06; Linksys E2500 v1/v2 2.0.00; Linksys E3000 1.0.06; Linksys E3200 1.0.05; Linksys E4200 1.0.06; Linksys E900 v1 1.0.04. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-34037 or the next vulnerability affects your stack