CVE-2025-34037

CVE-2025-34037 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. Its EPSS exploit-prediction score of 93% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-78.

Key facts

Description

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Frequently asked questions

What is CVE-2025-34037?
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
How severe is CVE-2025-34037?
CVE-2025-34037 has a CVSS 4.0 base score of 10.0, rated critical severity.
Is CVE-2025-34037 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 93% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-34037?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-34037 have an EU (EUVD) identifier?
Yes. CVE-2025-34037 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-18964.
When was CVE-2025-34037 published?
CVE-2025-34037 was published on 2025-06-24 and last updated on 2026-07-22.

References

Other CWE-78 (OS Command Injection) vulnerabilities

Browse all CWE-78 (OS Command Injection) vulnerabilities →