Linksys E9450
CVE-2025-52692
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local network foothold
-
DeliveryReach router web interface
-
ExploitSend crafted admin URL
-
ExecutionBypass missing authentication
-
PersistAccess administrative functions
-
ImpactAlter router configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have local/adjacent network access to the Linksys E9450 (firmware 1.2.00.052) - same LAN or Wi-Fi segment as the device - per AV:A; it is not directly reachable from the internet without prior network positioning. Given the access, no authentication, no user interaction, and no special configuration are needed: the attacker simply sends a crafted URL to the web management interface, which fails to enforce login on certain administration functions (CWE-306). The limiting factors are the adjacent-network requirement and the narrow affected footprint (a single consumer router firmware build). |
| Impact | This is a genuine priority within its deployment scope. The CVSS 8.8 (High) is driven by an unauthenticated missing-authentication flaw (CWE-306) reachable over the adjacent network (AV:A/AC:L/PR:N/UI:N) that yields full compromise of administrative functions (C:H/I:H/A:H). Public exploit code exists (POC=YES per the CSA Singapore advisory reference), which materially raises the practical threat versus a theoretical bug. However, the vulnerability is NOT in CISA KEV - there is no confirmation of active exploitation - and no EPSS score was supplied, so widespread automated exploitation cannot be quantified from the data. The single most important limiting factor is the attack vector: AV:A (adjacent/local network) means an attacker must already be on the same LAN/Wi-Fi segment as the device, not exploiting it directly from the internet. Net assessment: high impact and low complexity with working POC, but bounded by the requirement for local-network positioning and by the specific affected product (one Linksys router firmware build). |
| Exploit ScenarioDerived | An attacker who has gained access to the local network (e.g., via the router's Wi-Fi or a compromised LAN host) sends a specially crafted URL to the Linksys E9450 web management interface. Because the affected administration functions do not enforce login, the attacker reaches privileged configuration without credentials, enabling changes such as DNS, firewall, or credential settings. Publicly available exploit code lowers the skill required to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An authentication bypass in the Linksys E9450 (E9450-SG) router firmware 1.2.00.052 lets an attacker who already sits on the same LAN or Wi-Fi segment reach certain administrative functions by sending a crafted URL, without supplying any login credentials. No authentication, user interaction, or non-default configuration is required once adjacent-network access exists, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:A/PR:N). Publicly available exploit code exists and the flaw is documented in Singapore CSA alert AL-2025-118; there is no CISA KEV entry, so confirmed in-the-wild exploitation is not established, and the exposure is bounded by the adjacent-network prerequisite and the narrow single-firmware-build footprint.
RemediationAI
No vendor-released patch version is identified in the available data; check the Linksys support site for the E9450 (E9450-SG) and the Singapore CSA advisory AL-2025-118 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-118/) for firmware update guidance and apply the newest firmware build as soon as Linksys publishes one, since a public exploit already exists. Treating the device as unpatched until then, the highest-value compensating controls are to shrink the adjacent-network attack surface: keep the router's admin interface confined to a trusted wired segment and never expose it to guest Wi-Fi or untrusted VLANs, use WPA3 (or WPA2-AES with a long, unique pre-shared key) and disable WPS and any guest network that bridges to the management plane, and disable remote/WAN administration and UPnP/port-forwarding features that would let an off-LAN attacker first gain the AV:A positioning the exploit needs - the trade-off is reduced remote convenience and, for WPS in particular, loss of quick client onboarding. Where the layout permits, place the router behind a firewall rule set that blocks inbound HTTP/HTTPS to its management port from any segment other than the administrator's own host, and monitor router logs for unauthenticated requests to admin URLs as a detection signal; if a patch cannot be obtained promptly, replacing the E9450-SG in untrusted or shared-network environments is the only fully reliable mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-306 (Missing Authentication for Critical Function): the E9450 web management interface fails to enforce a session or credential check on certain administrative endpoints, so a request crafted with the correct URL path is processed as if it came from a logged-in administrator. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the two defining characteristics - the attack is mounted over an adjacent network (AV:A), so the attacker must first reach the device's management plane from the same broadcast/L2 segment rather than the public internet, and PR:N/UI:N mean the malicious request is unauthenticated and requires no victim interaction. CPE data pins the affected build precisely to cpe:2.3:o:linksys:e9450-sg_firmware:1.2.00.052, the Singapore-market E9450 SKU firmware; because the defect lives in the embedded HTTP management service, exploitation is protocol-level (a single crafted HTTP request), and the successful outcome gives the attacker the same administrative authority as an authenticated administrator, including configuration changes and device takeover.
Know when E9450 Sg Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network crafted URL (AV:A) needs no auth or interaction (PR:N/UI:N) and reaches admin functions granting full device control (C:H/I:H/A:H).
Primary rating from Vendor (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4).
CVSS VectorVendor: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
DescriptionCVE.org
Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.
Executive ViewAI
Organizations using Linksys E9450 or E9450-SG routers on firmware 1.2.00.052 face a high-risk exposure: an unauthenticated attacker who can reach the same LAN or Wi-Fi segment can gain administrative control of the device without credentials. Publicly available exploit code exists, and no vendor patch is currently available. Leadership should care because a compromised router can silently redirect traffic, alter security settings, and disrupt connectivity for all users on that segment, especially in branch, retail, or remote-worker networks.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected Linksys E9450/E9450-SG firmware 1.2.00.052 devices on a dedicated management VLAN, restricting admin interface access via firewall or ACLs to trusted admin hosts only, disabling remote administration and guest network access to the admin interface, enabling configuration-change logging and alerting, and replacing or decommissioning the device if it cannot be adequately segmented.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB