Linksys EA6350 CVE-2025-44657

Exploitation requires that the FTP service on the Linksys EA6350 is enabled and network-accessible - FTP is not enabled by default on all router configurations, so this condition must be verified. The attacker must possess valid FTP user credentials (PR:L in CVSS confirms authentication is required); unauthenticated exploitation is not indicated. The vulnerability is specific to firmware version 2.1.2 and arises from the dynamically generated vsftpd configuration enabling chroot_local_user without appropriate write-protection controls on the chroot directory. The CVSS UI:R metric suggests some form of interaction may be needed (possibly an administrator triggering the dynamic config generation), though this is not explicitly detailed in the available description. Exploitation is limited to environments where FTP is actively enabled and exposed - routers with FTP disabled are not affected regardless of firmware version.

The NVD-assigned CVSS 3.1 score of 3.9 (Low) reflects the constrained attack surface: AV:L requires local access, PR:L requires existing low-privilege credentials, and UI:R indicates some form of user interaction is necessary, which substantially limits opportunistic exploitation. EPSS at 0.28% (20th percentile) confirms very low observed exploitation probability relative to other CVEs in the corpus. The device has no CISA KEV listing, and the sole reference is a researcher-authored GitHub Gist rather than a vendor advisory, indicating this was independently discovered without confirmed in-the-wild exploitation. However, the CVSS AV:L metric may underrepresent the actual attack surface: FTP is a network-exposed service on the EA6350, meaning an attacker with valid FTP credentials could exploit this remotely, not purely from local console access - a tension that should be verified against the device's actual service exposure. The pivot-point risk noted in the description is credible for a home/SMB router: exploitation could expose internal network topology or facilitate lateral movement if the router bridges VLANs or multiple subnets. Overall, this is a real but niche risk - meaningful only to environments where EA6350 firmware 2.1.2 is deployed with FTP enabled and where internal network access is sensitive.

An attacker who obtains valid FTP credentials for the Linksys EA6350 - through credential stuffing, default credential abuse, or prior reconnaissance - connects to the device's FTP service and exploits the improperly configured chroot_local_user directive to traverse outside the intended home directory jail. Once outside the chroot, the attacker can read sensitive router configuration files, extract stored credentials or private keys, and use the router's trusted internal network position to probe or pivot into connected LAN segments. No public proof-of-concept exploit has been confirmed, but the technique is well-understood for vsftpd chroot misconfigurations and requires no advanced tooling.