CVE-2025-34037

Public Exploit
Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

Description

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability is exploited in the wild by the "TheMoon" worm to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. This vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers.

Category

10.0
CVSS
Severity: Critical
CVSS 4.0 •
EPSS 1.28% Top 25%
Third-Party Advisory exploit-db.com Third-Party Advisory vulncheck.com
Affected: Linksys E4200
Affected: Linksys E3200
Affected: Linksys E3000
Affected: Linksys E2500 v1/v2
Affected: Linksys E2100L v1
Affected: Linksys E2000
Affected: Linksys E1550
Affected: Linksys E1500 v1
Affected: Linksys E1200 v1
Affected: Linksys E1000 v1
Affected: Linksys E900 v1
Published at:
Updated at:

References

Link Tags
https://isc.sans.edu/diary/17633 technical description
https://www.exploit-db.com/exploits/31683 third party advisory exploit
https://vulncheck.com/advisories/linksys-routers-command-injection third party advisory

Frequently Asked Questions

What is the severity of CVE-2025-34037?
CVE-2025-34037 has been scored as a critical severity vulnerability.
How to fix CVE-2025-34037?
To fix CVE-2025-34037, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-34037 being actively exploited in the wild?
It is possible that CVE-2025-34037 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-34037?
CVE-2025-34037 affects Linksys E4200, Linksys E3200, Linksys E3000, Linksys E2500 v1/v2, Linksys E2100L v1, Linksys E2000, Linksys E1550, Linksys E1500 v1, Linksys E1200 v1, Linksys E1000 v1, Linksys E900 v1.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.