External risk intelligence

Linksys E-Series Router Command Injection

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-34037

The vulnerability affects consumer networking equipment (routers and access points) via HTTP endpoints. These devices are designed to be connected directly to the internet, and the management or configuration interfaces described are typically accessible over the network as part of their primary function as edge gateways.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An OS command injection vulnerability has been identified in certain Linksys routers, allowing unauthenticated attackers to inject commands through specific web endpoints. This flaw could enable unauthorized code execution on affected devices, potentially impacting network security and stability.

Commands can be injected into routers.
Affects consumer networking equipment directly connected to the internet.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit a vulnerability in Linksys routers by sending unauthenticated HTTP requests to specific endpoints. These requests can contain specially crafted input that is not properly sanitized, allowing an attacker to inject and execute arbitrary operating system commands. This could lead to the complete compromise of the affected router.

No authentication required for access.
Vulnerable endpoints accept unsanitized user input.
Arbitrary code execution on the router.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could exploit an OS command injection vulnerability in Linksys E-Series routers, and potentially other Linksys models, by sending unsanitized input to specific HTTP endpoints. This could allow for arbitrary code execution on the router, a scenario observed in the wild.

Router system data and control.
Inject commands via HTTP network requests.
Arbitrary code execution on router.

Operational Fix

Recommended remediation, mitigation, and detection steps

System and network owners are responsible for identifying and securing internet-facing Linksys E-Series routers and other affected models. The immediate first step is to determine the presence and reachability of these devices, confirm their business criticality, and identify the accountable owner for remediation planning.

Network and system owners should track.
Verify internet-facing devices and services.
Plan staged remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linksys E-Series router and its role in a network?

These devices act as edge gateways, connecting home or small office networks to the internet. They manage traffic flow, provide Wi-Fi connectivity, and handle initial network security for connected devices like computers, phones, and smart home appliances.

What is OS command injection in the context of CVE-2025-34037?

This vulnerability, classified as CWE-78, occurs when a device fails to clean user-supplied data before processing it. In this case, specific web scripts on the router treat malicious input as system commands. This allows an attacker to manipulate the router's operating system directly, potentially gaining full control over its functions and the traffic passing through it.

How do attackers trigger this vulnerability on a router?

An attacker sends a specially crafted HTTP request to specific configuration endpoints on port 8080. The router processes the 'ttcp_ip' parameter without verifying if the input is safe. This bug is specifically triggered by network-based communication; requests that do not target these specific management endpoints or are not formatted as HTTP requests will not trigger this command injection.

Why should I be concerned about this if I use these routers?

According to Halo Surface Signal, this vulnerability affects networking equipment frequently placed at the network edge. Because these routers are designed to be connected directly to the internet, their management interfaces are often exposed. If your device is accessible from the internet, it faces a higher likelihood of being targeted by unauthorized actors.

How do I respond to the risks identified with CVE-2025-34037?

Start by auditing your network to identify all Linksys E-Series or related WAG/WAP/WES/WET/WRT models in use. Verify if these devices are directly reachable from the internet. Once located, assess their role in your environment and coordinate with your internal technical teams to determine a remediation plan, such as restricting interface access or engaging with the vendor for updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.