Record status Published
Identifier year (not publication year) 2025
Source publication Jun 24, 2025
Source updated Jul 22, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
E4200
Vendor Linksys
Product E4200
Platforms Unknown
Default status unaffected
E4200 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 1.0.06 Unavailable None listed
E3200
Vendor Linksys
Product E3200
Platforms Unknown
Default status unaffected
E3200 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 1.0.05 Unavailable None listed
E3000
Vendor Linksys
Product E3000
Platforms Unknown
Default status unaffected
E3000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 1.0.06 Unavailable None listed
E2500 v1/v2
Vendor Linksys
Product E2500 v1/v2
Platforms Unknown
Default status unaffected
E2500 v1/v2 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 2.0.00 Unavailable None listed
E2100L v1
Vendor Linksys
Product E2100L v1
Platforms Unknown
Default status unaffected
E2100L v1 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 1.0.05 None listed
E2000
Vendor Linksys
Product E2000
Platforms Unknown
Default status unaffected
E2000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable Unavailable None listed
E1550
Vendor Linksys
Product E1550
Platforms Unknown
Default status unaffected
E1550 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 1.0.03 None listed
E1500 v1
Vendor Linksys
Product E1500 v1
Platforms Unknown
Default status unaffected
E1500 v1 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 1.0.06 Unavailable None listed
E1200 v1
Vendor Linksys
Product E1200 v1
Platforms Unknown
Default status unaffected
E1200 v1 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 1.0.04 None listed
E1000 v1
Vendor Linksys
Product E1000 v1
Platforms Unknown
Default status unaffected
E1000 v1 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 2.1.03 Unavailable None listed
E900 v1
Vendor Linksys
Product E900 v1
Platforms Unknown
Default status unaffected
E900 v1 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom 1.0.04 Unavailable None listed