CVE-2025-34037

CVE-2025-34037 is an unauthenticated OS command injection flaw (CWE-78) in the /tmUnblock.cgi and /hndUnblock.cgi CGI scripts of various Linksys E-Series routers, reachable over HTTP on port 8080. An attacker sends HTTP requests with a crafted ttcp_ip parameter, which the scripts pass to the shell without sanitization, allowing injected shell commands to run on the device. Successful exploitation yields arbitrary command and code execution on the router — the 2014 "TheMoon" worm used this flaw to drop a MIPS ELF payload — enabling device takeover, persistence, or botnet enrollment. Various E-Series models are affected, and the flaw may also extend to other Linksys WAG/WAP/WES/WET/WRT-series routers and Wireless-N access points/routers. Exploitation was observed in the wild as recently as 2025-02-06 by the Shadowserver Foundation (and famously by TheMoon in 2014); the flaw carries a maximum-severity CVSS 4.0 score of 10 and a top-percentile 90.9% EPSS, related news of the RondoDox botnet targeting 56 flaws across 30+ device types underscores ongoing botnet pressure on router-class devices, and it is not yet listed in CISA KEV.

What to do: Identify whether any Linksys router on your networks exposes its port 8080 HTTP management interface from untrusted/WAN networks and check whether /tmUnblock.cgi or /hndUnblock.cgi responds; if so, block or restrict port 8080 (or disable remote administration) until vendor firmware updates become available — no fixed version is specified in the available data. Hunt for signs of compromise consistent with TheMoon-style MIPS ELF payloads, such as unexpected processes or services, added backdoor listeners, and anomalous outbound traffic, and prioritize patching given the top-percentile EPSS (90.9%) and fresh in-the-wild exploitation.