CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Засегнати продукти
- Linksys E4200: преди 1.0.06
- Linksys E3200: преди 1.0.05
- Linksys E3000: преди 1.0.06
- Linksys E2500 v1/v2: преди 2.0.00
- Linksys E2100L v1: до 1.0.05
- Linksys E2000: 0
- Linksys E1550: до 1.0.03
- Linksys E1500 v1: преди 1.0.06
- Linksys E1200 v1: до 1.0.04
- Linksys E1000 v1: преди 2.1.03
- Linksys E900 v1: преди 1.0.04
Вид слабост
История
- 24 юни 2025 Публикувано
Други уязвимости в Linksys E4200
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2025-34037
- https://nvd.nist.gov/vuln/detail/CVE-2025-34037
- https://isc.sans.edu/diary/17633
- https://www.exploit-db.com/exploits/31683
- https://vulncheck.com/advisories/linksys-routers-command-injection
- https://github.com/Jarrettgohxz/CVE-research/tree/main/Linksys/E-series/CVE-2025-34037