CVE-2025-34037

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 92.77%
EPSS Percentile: 99.83%
CISA KEV: Not listed

Description

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: disclosure@vulncheck.com
Published: 24-Jun-2025 08:15
Last Modified: 22-Jul-2026 23:17
EPSS Date: 2026-10-13
CWE: CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 14-Oct-2026 09:18
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2025-34037 CYFIRMA Report Maps Cyber Threats Facing India and SAARC Telecom Sector
CVE-2025-34037 Linksys ttcp_ip ClingSTUN Linux Backdoor Abuses Public STUN Services to Control Compromised IoT Devices

CVE (43)

Malware (7)

People (1)

Threat Actors (33)

MITRE ATT&CK (22)

Vendors (29)

Products (26)

Tools (9)

Industries (14)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.