What breaks and who should care
An OS command injection flaw has been identified in a range of Linksys routers that expose the /tmUnblock.cgi and /hndUnblock.cgi scripts over HTTP on port 8080. If you run any of the affected devices in a network that can be reached by an unauthenticated attacker, you are at risk of remote code execution.
We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.
This is a critical issue – the CVSS score is the maximum possible, 10.0. The vulnerability has been observed in the wild, with evidence logged by the Shadowserver Foundation on 6 February 2025.
How the vulnerability works
The two CGI endpoints accept a query parameter called ttcp_ip. The router firmware concatenates the value of that parameter directly into a shell command line and executes it without any sanitisation. An attacker can therefore supply arbitrary shell syntax and cause the router to run any command the underlying operating system permits.
Because the scripts are reachable over plain HTTP, no authentication is required. An attacker only needs to know the IP address of the router and that the management interface is listening on port 8080. Once a command runs, the attacker can download or execute a payload – the historic “TheMoon” worm used this path to drop a MIPS ELF binary on the device, giving the worm full control.
The class of bug is an OS command injection, sometimes called an “unfiltered shell execution” flaw. The specific payload handling is not publicly detailed beyond what the NVD entry says, but the impact is clear: arbitrary code execution with the privileges of the router’s web service, which on most devices means root‑level access.
Who is affected
The NVD lists “various models of E‑Series Linksys routers” as vulnerable. It also notes that the issue may extend to other Linksys families – WAG, WAP, WES, WET, WRT series and Wireless‑N access points. No official version list has been published, so you must consult the table below that the NVD supplies for the exact models and firmware releases that are patched.
In short, if you have any Linksys router that still runs the default web management interface on port 8080, you should assume it could be in scope until you can confirm otherwise.
How to determine if you are exposed
The quickest way to test is to send a harmless request to the CGI endpoint and see how the device responds. Use curl from a machine that can reach the router:
curl -s -o /dev/null -w "%{http_code}" http://router-ip:8080/tmUnblock.cgi?ttcp_ip=127.0.0.1
If the HTTP status code is 200, the script exists and is reachable. A 404 means the endpoint is not present – perhaps the firmware is already patched or the device does not expose that path.
To confirm that the parameter is not being filtered, you can try a benign command that produces a visible change, such as creating a temporary file:
curl "http://router-ip:8080/tmUnblock.cgi?ttcp_ip=;touch%20/tmp/poc"
After the request, log in to the router’s admin UI and check whether /tmp/poc exists (or use ssh if you have console access). If the file appears, the injection works on your device.
Do not run destructive commands – the goal is only to verify the behaviour.
Immediate mitigations you can apply now
While you arrange a firmware upgrade, you can cut off the attack surface with a few network‑level steps.
- Block inbound traffic to port 8080 on the router’s LAN and WAN interfaces. A single
iptablesrule on your upstream firewall will do:
iptables -A INPUT -p tcp --dport 8080 -j DROP- If the router is only used for local management, restrict access to the management network. Place the device in a VLAN that is not reachable from untrusted hosts.
- Disable the HTTP management interface if you do not need it. Most Linksys firmware offers a setting to turn off the web UI on port 8080.
- Enable HTTPS management on a different port, if the firmware supports it, and make sure strong passwords are in place.
These steps do not remove the flaw, but they prevent an unauthenticated attacker from reaching the vulnerable scripts.
Patch and upgrade path
The vendor has released patched firmware for the affected branches. The exact release numbers are listed in the table below – you should download the latest version for your device’s model and apply it according to the manufacturer’s instructions.
In practice the upgrade process is the same as any other firmware refresh: log in to the router’s admin UI, navigate to the firmware upgrade page, upload the file, and let the device reboot.
After the upgrade, repeat the curl test from the earlier section. You should now receive a 404 or another error code, indicating the CGI endpoint is no longer present.
If a patch is not yet available
Some older hardware may never receive an official fix. In that case you have two practical options.
- Isolate the device completely. Remove it from any network that can reach the internet, and use it only for the specific function it was bought for (for example, a dedicated Wi‑Fi hotspot for a closed lab).
- Replace the device with a model that is actively maintained. Modern routers include built‑in mitigations such as mandatory input sanitisation and signed firmware.
While you wait for a vendor response, keep the firewall rule that drops port 8080 traffic. Regularly audit the device for any new open services.
Additional hardening recommendations
- Change default credentials immediately. Weak passwords make it trivial for an attacker who gains any foothold to pivot.
- Enable logging on the router and forward logs to a central syslog server. Look for HTTP requests to
/tmUnblock.cgior/hndUnblock.cgi– they are a clear sign of probing. - Run a regular vulnerability scan against your own network. Schedule it to run after any firmware change so you can spot regressions.
- Consider network‑level intrusion detection. A rule that flags HTTP requests containing the string “ttcp_ip=” followed by a semicolon is a cheap way to catch exploitation attempts.
What to do after you have patched
Once the firmware is updated, verify that the router no longer accepts the malicious request. Run the same curl command; a 404 or 403 response means the endpoint is gone or access is denied.
Review the router’s configuration for any leftover changes the attacker might have made – for example, new firewall rules, altered DNS settings, or added admin users. Reset the configuration to a known‑good baseline if you see anything suspicious.
Finally, document the incident. Note the date of the scan, the steps you took, and the version you upgraded to (copy it from the table below). This will help you demonstrate compliance during audits.
References
- NVD entry for CVE-2025-34037 – includes the vulnerability description and the table of affected and fixed releases.
- Shadowserver Foundation report, 6 February 2025 – evidence of exploitation in the wild.
- Linksys firmware release notes – provide the exact patch for each model.
The table below is automatically populated from the NVD and shows which models are vulnerable and which firmware releases contain the fix.
Affected versions
NVD has not published machine-readable version ranges for CVE-2025-34037 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
