Linksys E5600 CVE-2025-29229

The specific prerequisite is network reachability to the Linksys E5600 (firmware 1.1.0.26) web management interface and the ability to invoke the ddnsStatus function/handler, into which OS commands can be injected. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, so default-configuration exploitation is implied; however, the exact vulnerable parameter and the trigger mechanism are not described in the available sources, and whether a prior session/login to the admin interface is actually needed is not confirmed by the description. The main limiting factor is exposure of the router's management interface: risk is high where that interface is internet-facing or attacker-reachable on the LAN, and substantially lower where management access is restricted.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) describes a maximally severe network-reachable command injection, and the vuln.today Decision label is 'act_now', which argues for prompt remediation. However, this high severity is partly offset by exploitation-likelihood data: EPSS is only 1.27% (70th percentile), which is moderate rather than high, and the vulnerability is NOT in the CISA KEV catalog, so there is no confirmed active exploitation. A public PoC/write-up reference exists on GitHub but is not verified as working weaponized exploit code. The result is a classic high-CVSS / moderate-real-world-likelihood profile: genuinely dangerous where the device's management interface is reachable by an attacker (especially if exposed to the internet), but not yet evidenced as mass-exploited. One caveat: the CVSS vector asserts PR:N (unauthenticated), yet the one-line description gives no detail on how ddnsStatus is reached or whether a prior login is required - this should be verified against the vendor/PoC before treating unauthenticated access as confirmed.

An attacker with network access to the Linksys E5600 web management interface sends a crafted request to the ddnsStatus function, injecting operating-system commands that the device executes with the privileges of the web service. Per the CVSS vector this requires no authentication, no user interaction, and low attack complexity. A public PoC reference exists describing the ddnsStatus command injection, though it is not verified as working exploit code.