{"id":"CVE-2025-34037","aliases":["EUVD-2025-18964","GHSA-4c6f-v7q4-2m38"],"status":"published","title":"Linksys Routers E/WAG/WAP/WES/WET/WRT-Series","description":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the \"TheMoon\" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.96154,"percentile":0.99877,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-78"],"published":"2025-06-24T01:03:27Z","modified":"2026-07-22T18:32:49Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/linksys_themoon_exec","title":"Linksys E-Series TheMoon Remote Command Injection","type":"exploit","platform":"Linux","date":"2014-02-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/linksys_themoon_exec"},{"source":"pocgithub","id":"Taxanehh/CVE-2025-34037","title":"Taxanehh/CVE-2025-34037","date":"2026-03-26","url":"https://github.com/Taxanehh/CVE-2025-34037"}],"products":[{"vendor":"linksys","product":"e1000 v1"},{"vendor":"linksys","product":"e1200 v1"},{"vendor":"linksys","product":"e1500 v1"},{"vendor":"linksys","product":"e1550"},{"vendor":"linksys","product":"e2000"},{"vendor":"linksys","product":"e2100l v1"},{"vendor":"linksys","product":"e2500 v1/v2"},{"vendor":"linksys","product":"e3000"},{"vendor":"linksys","product":"e3200"},{"vendor":"linksys","product":"e4200"},{"vendor":"linksys","product":"e900 v1"}],"references":[{"url":"https://isc.sans.edu/diary/17633","tags":["technical-description"]},{"url":"https://www.exploit-db.com/exploits/31683","tags":["third-party-advisory","exploit"]},{"url":"https://vulncheck.com/advisories/linksys-routers-command-injection","tags":["third-party-advisory"]},{"url":"https://github.com/Jarrettgohxz/CVE-research/tree/main/Linksys/E-series/CVE-2025-34037"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34037"},{"url":"https://github.com/advisories/GHSA-4c6f-v7q4-2m38"}],"sources":{"cve":[{"id":"CVE-2025-34037","title":"Linksys Routers E/WAG/WAP/WES/WET/WRT-Series","description":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the \"TheMoon\" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.","status":"published","published":"2025-06-24T01:03:27.693Z","modified":"2026-07-22T14:59:37.943Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:54.534202Z"}],"euvd":[{"id":"EUVD-2025-18964","description":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the \"TheMoon\" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.","status":"published","published":"2025-06-24T01:03:27Z","modified":"2026-07-22T14:59:37Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:19:46.391735Z"}],"ghsa":[{"id":"GHSA-4c6f-v7q4-2m38","title":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via...","description":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability is exploited in the wild by the \"TheMoon\" worm to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. This vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers.","status":"published","published":"2025-06-26T21:31:03Z","modified":"2026-07-22T18:32:49Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-20","CWE-78"],"updated_at":"2026-11-02T15:09:39.885892Z"}],"nvd":[{"id":"CVE-2025-34037","description":"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the \"TheMoon\" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.","status":"published","published":"2025-06-24T01:15:25.037Z","modified":"2026-07-22T16:17:05.52Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:14.091082Z"}]}}