CVE-2025-34037
CriticalCVSS 10.0Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
An OS command injection vulnerability in various Linksys E-Series routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints on HTTP port 8080. The ttcp_ip parameter is unsanitized, allowing unauthenticated attackers to inject shell commands. Exploited by the TheMoon worm in 2014 and observed again in 2025.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary commands on the router, leading to full device compromise and potential botnet inclusion.
Recommendation
Update the Linksys router firmware to the latest version or apply a workaround if no update is available. Restrict external access to port 8080.
Original NVD description (English source)
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.