EUVD-2025-18964CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Lifecycle Timeline
4Tags
Description
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability is exploited in the wild by the "TheMoon" worm to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. This vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Analysis
Multiple Linksys E-Series router models contain an unauthenticated OS command injection vulnerability in the /tmUnblock.cgi and /hndUnblock.cgi endpoints accessible on port 8080. The ttcp_ip parameter is passed directly to a system shell without sanitization, enabling remote root-level command execution on the router.
Technical Context
The tmUnblock.cgi and hndUnblock.cgi scripts process the ttcp_ip parameter by passing it directly to a system() call without input validation. Since the web server runs as root on the router, injected commands execute with full root privileges. Port 8080 hosts an alternative web interface that may be accessible remotely if remote management is enabled.
Affected Products
['Linksys E1200', 'Linksys E2500', 'Linksys E3200', 'Linksys E4200', 'Other Linksys E-Series models']
Remediation
Update router firmware to the latest version. Disable remote management on port 8080. Replace end-of-life Linksys routers with actively maintained models. Place IoT devices behind a firewall that blocks inbound management ports.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today