Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2025-34037 EUVD-2025-18964GHSA-4c6f-v7q4-2m38

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

Published Jun 24, 2025 · Updated Jul 22, 2026 · Assigned by VulnCheck

Vendor: Linksys Product: E1000 v1 Product: E1200 v1 Product: E1500 v1 Product: E1550 Product: E2000 Product: E2100L v1 Product: E2500 v1/v2 Product: E3000 Product: E3200 Product: E4200 Product: E900 v1

Description

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Affected products

VendorProductAffectedFixed
Linksys E4200 < 1.0.06 1.0.06
Linksys E3200 < 1.0.05 1.0.05
Linksys E3000 < 1.0.06 1.0.06
Linksys E2500 v1/v2 < 2.0.00 2.0.00
Linksys E2100L v1 ≤ 1.0.05 —
Linksys E2000 — —
Linksys E1550 ≤ 1.0.03 —
Linksys E1500 v1 < 1.0.06 1.0.06
Linksys E1200 v1 ≤ 1.0.04 —
Linksys E1000 v1 < 2.1.03 2.1.03
Linksys E900 v1 < 1.0.04 1.0.04

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References