CVE-2025-34037: Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcpip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34037?
CVE-2025-34037 is classified as a high-severity OS command injection vulnerability.
How do I fix CVE-2025-34037?
To fix CVE-2025-34037, update your Linksys E-Series routers with the latest firmware provided by the manufacturer.
Which devices are affected by CVE-2025-34037?
CVE-2025-34037 affects various models of Linksys E-Series routers, WAG/WAP/WES/WET/WRT-series routers, and Wireless-N access points.
What type of vulnerability is CVE-2025-34037?
CVE-2025-34037 is an OS command injection vulnerability that allows an attacker to send malicious commands to the router.
How does CVE-2025-34037 exploit user input?
CVE-2025-34037 exploits untrusted user-supplied input in CGI scripts that incorrectly validates the ttcp_ip parameter.