Attack Chain

1. The attacker identifies a target Linksys E1200 device accessible over the network (LAN or WAN).
2. The attacker prepares a payload containing a shell script string, such as a reverse shell setup using mkfifo and telnet.
3. The attacker crafts an HTTP POST request targeting the /tmUnblock.cgi endpoint.
4. The malicious shell commands are injected into the ttcp_ip parameter within the request body.
5. The router processes the POST data and passes the unsanitized ttcp_ip value to a system call.
6. The injected commands execute with elevated privileges on the router.
7. The final command (e.g., telnet) connects back to the attacker's listener, providing an interactive command shell.

Impact

Successful exploitation allows for full control of the router, potentially enabling an attacker to intercept network traffic, modify DNS settings, pivot into the internal network, or permanently disable the device. The vulnerability affects all Linksys E1200 devices running firmware version 2.0.04 or older, which are common in small office and home office (SOHO) environments.

Recommendation

1. Restrict access to the router management interface to trusted internal IP addresses only.
2. If a firmware update is unavailable from the vendor, isolate the affected Linksys E1200 device from public-facing segments.
3. Deploy web application firewall or IDS/IPS signatures to detect POST requests to /tmUnblock.cgi containing shell metacharacters in the ttcp_ip parameter.
4. Monitor for unexpected outbound connections from router hardware, particularly those utilizing the telnet protocol, as indicated in the CVE-2025-60689 exploit PoC.