SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
◆ WATCHCVE-2025-34037 · CVSS 10.0

Linksys E4200: attackers can run their own code

AFFECTSLinksys E4200Linksys E3200Linksys E3000Linksys E2500 V1/v2Linksys E2100l V1Linksys E2000Linksys E1550Linksys E1500 V1Linksys E1200 V1Linksys E1000 V1Linksys E900 V1

OFFICIAL NAME: Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

WHAT IT IS · ROUTERS, CAMERAS AND DEVICESRouters, cameras and recorders are often forgotten and rarely updated.

DO THIS FIRSTUpdate it or replace it. Never leave its admin page open to the internet. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands.

WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.

WHY IT RANKS HERE Ready-made attack tools are public. The first report is 20 days old. 11 products are affected.

HIGHEST CONFIRMED RUNG
TRIED
CISA KEV
NOT YET
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attack attempts on CVE-2025-34037 seen by honeypots (Shadowserver via CIRCL). Attack attempts on CVE-2025-34037 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2025-34037 published
  2. EXPLOIT CODE PUBLIC
    DATE UNKNOWN
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 485 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. FEB 12, 2014
    Metasploit exploit module: Linksys E-Series TheMoon Remote Command Injection
  2. JUN 23, 2025
    CISA Vulnrichment notes a public proof of concept for CVE-2025-34037
  3. MAR 26, 2026
    1 public GitHub repository claims a proof of concept for CVE-2025-34037
  4. Attack activity. OCT 21, 2026
    Attack attempts on CVE-2025-34037 seen by honeypots (Shadowserver via CIRCL) (2 reports, latest OCT 22)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2025-34037 seen by honeypots (Shadowserver via CIRCL), OCT 22
  2. [2] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2025-34037, MAR 26
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment notes a public proof of concept for CVE-2025-34037, JUN 23
  4. [4] Metasploit module metadata: Metasploit exploit module: Linksys E-Series TheMoon Remote Command Injection, FEB 12