Unauthenticated OS Command Injection in Linksys E1200

Linksys E1200 routers, specifically those running firmware version 2.0.04 and earlier, are susceptible to an unauthenticated OS command injection vulnerability (CVE-2025-60689). The vulnerability exists within the tmUnblock.cgi script, which fails to properly sanitize input provided to the ttcp_ip parameter during an HTTP POST request. By injecting shell metacharacters and commands into this parameter, an unauthenticated attacker can achieve arbitrary command execution with high privileges on the underlying Linux-based firmware. A proof-of-concept exploit is publicly available, which leverages this flaw to establish a reverse shell connection to an attacker-controlled listener. This vulnerability poses a significant risk to internal networks where these devices are deployed, as they often serve as the perimeter or routing gateway.

Attack Chain

1. The attacker identifies a target Linksys E1200 device accessible over the network (LAN or WAN).
2. The attacker prepares a payload containing a shell script string, such as a reverse shell setup using mkfifo and telnet.
3. The attacker crafts an HTTP POST request targeting the /tmUnblock.cgi endpoint.
4. The malicious shell commands are injected into the ttcp_ip parameter within the request body.
5. The router processes the POST data and passes the unsanitized ttcp_ip value to a system call.
6. The injected commands execute with elevated privileges on the router.
7. The final command (e.g., telnet) connects back to the attacker's listener, providing an interactive command shell.

Impact

Successful exploitation allows for full control of the router, potentially enabling an attacker to intercept network traffic, modify DNS settings, pivot into the internal network, or permanently disable the device. The vulnerability affects all Linksys E1200 devices running firmware version 2.0.04 or older, which are common in small office and home office (SOHO) environments.

Recommendation

1. Restrict access to the router management interface to trusted internal IP addresses only.
2. If a firmware update is unavailable from the vendor, isolate the affected Linksys E1200 device from public-facing segments.
3. Deploy web application firewall or IDS/IPS signatures to detect POST requests to /tmUnblock.cgi containing shell metacharacters in the ttcp_ip parameter.
4. Monitor for unexpected outbound connections from router hardware, particularly those utilizing the telnet protocol, as indicated in the CVE-2025-60689 exploit PoC.