CVE-2025-34037

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

• CWE-78

• https://isc.sans.edu/diary/17633
• https://vulncheck.com/advisories/linksys-routers-command-injection
• https://www.exploit-db.com/exploits/31683
• https://github.com/Jarrettgohxz/CVE-research/tree/main/Linksys/E-series/CVE-2025-34037

Published

Jun 24, 2025

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34031A path traversal vulnerability exists in the Moodle LMS Jmol…7.5
• CVE-2025-34032A reflected cross-site scripting (XSS) vulnerability exists …6.1
• CVE-2025-34033An OS command injection vulnerability exists in the Blue Ang…8.8
• CVE-2025-34034A hardcoded credential vulnerability exists in the Blue Ange…8.8
• CVE-2025-34035An OS command injection vulnerability exists in EnGenius EnS…9.8
• CVE-2025-34036An OS command injection vulnerability exists in white-labele…9.8
• CVE-2025-34038A SQL injection vulnerability exists in Weaver E-cology 8.0 …7.5
• CVE-2025-34039A code injection vulnerability exists in Yonyou UFIDA NC v6.…10
• CVE-2025-3404The Download Manager plugin for WordPress is vulnerable to a…8.8
• CVE-2025-34040An arbitrary file upload vulnerability exists in the Zhiyuan…10
• CVE-2025-34041An OS command injection vulnerability exists in the Chinese …10
• CVE-2025-34042An authenticated command injection vulnerability exists in t…9.4