Loading vulnerability…
CVE-2025-34037 is an unauthenticated OS command injection vulnerability affecting various Linksys E-Series routers, and potentially additional Linksys product lines, in CGI handlers exposed over HTTP on port 8080. The flaw is present in the /tmUnblock.cgi and /hndUnblock.cgi endpoints, which improperly process attacker-controlled input supplied through the ttcp_ip parameter without adequate sanitization before passing it to the underlying shell environment. By embedding shell metacharacters or command sequences in that parameter, a remote attacker can cause arbitrary operating system commands to be executed on the router. Historical reporting associates this weakness with exploitation by the TheMoon worm to deploy a MIPS ELF payload, and exploitation evidence was observed again in 2025, indicating continued operational relevance for botnet propagation and router compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit for unauthenticated command injection/RCE against vulnerable Linksys router CGI endpoints, primarily tmUnblock.cgi, with hndUnblock.cgi noted as an alternative. The repository contains only two files: a README describing the vulnerability, affected models, and usage, and a single executable script, exploit.py, which is the main entry point. The exploit works by crafting raw HTTP POST requests to the vulnerable CGI endpoint and injecting shell commands through the ttcp_ip form parameter. It percent-encodes the POST body, includes a Basic Authorization header with arbitrary credentials, and sends the request directly over a TCP socket to the target web service on port 80. The script first removes any previous payload from /tmp/c0d3z, then uploads an embedded base64-encoded MIPS little-endian ELF bind shell in 20-byte chunks using repeated echo -en commands with octal byte escapes. After staging, it chmods the file to make it executable, runs it via another injected command, waits briefly, and then connects to the bind shell on TCP port 4444. Capabilities include unauthenticated remote code execution, payload staging to the target filesystem, permission modification, payload execution, and an interactive post-exploitation shell over the bind socket. The exploit is operational rather than a simple proof of concept because it contains a complete hardcoded payload and an interactive shell handler. No external C2 infrastructure is used; all communication is direct between the attacker and the target router. The main fingerprintable artifacts are the vulnerable CGI paths, the temporary payload file /tmp/c0d3z, the default target IP 192.168.8.100, and the bind shell listener on port 4444.
This repository contains a single Metasploit module (modules/exploits/linux/http/linksys_themoon_exec.rb) that exploits a remote command injection vulnerability (CVE-2025-34037) in several Linksys E-Series routers. The exploit targets the /tmUnblock.cgi endpoint, which is accessible without authentication, and injects commands via the 'ttcp_ip' POST parameter. The module uses Metasploit's CmdStager to deliver staged payloads, typically resulting in a remote shell on the device. The exploit is weaponized, supporting both MIPS little-endian and big-endian architectures, and is effective against a range of Linksys routers, with E1500 v1.0.5 specifically tested. The code is structured as a standard Metasploit module, leveraging the HttpClient and CmdStager mixins for network communication and payload delivery.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific CVE for which exploit code is implemented in native C inside TuxBot, but the exploit engine is dead code and never called at runtime in the analyzed version.
A critical command injection vulnerability in the /tmUnblock.cgi CGI endpoint of Linksys E-series routers that remains actively weaponized by botnets.
A command injection vulnerability in Linksys E-Series routers, exploited by RondoDox.
A vulnerability in Linksys devices exploited by the RondoDox botnet.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.