Cyber Resilience

CVE-2025-29228

CriticalRCE

Published: 23 December 2025

Published
23 December 2025
Modified
06 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0113 62.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29228 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-29228 is a command injection vulnerability (CWE-77) affecting the Linksys E5600 router on firmware version V1.1.0.26. The issue occurs in the runtime.macClone function, where the mc.ip parameter fails to properly sanitize user input, enabling attackers to inject and execute arbitrary shell commands. Published on 2025-12-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its severe potential impact.

Any unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows remote arbitrary command execution, resulting in high confidentiality, integrity, and availability impacts, such as full device compromise, data theft, or further network pivoting.

Details on exploitation and potential mitigations are available in the referenced advisory at https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_macClone_mc.ip/CI_macClone_mc.ip.md. No vendor patches or additional official remediation guidance are specified in the available information.

EU & UK References

Vulnerability details

Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing router web interface (T1190) via command injection for arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-29230Same product: Linksys E5600
CVE-2025-29229Same product: Linksys E5600
CVE-2024-57539Same vendor: Linksys
CVE-2025-9146Same product: Linksys E5600
CVE-2024-57225Same vendor: Linksys
CVE-2026-6992Same vendor: Linksys
CVE-2025-8821Same vendor: Linksys
CVE-2024-57227Same vendor: Linksys
CVE-2024-57536Same vendor: Linksys
CVE-2024-57228Same vendor: Linksys

Affected Assets

linksys
e5600 firmware
1.1.0.26

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates command injection by requiring validation and sanitization of the unsanitized mc.ip parameter in the runtime.macClone function.

SI-2 Flaw Remediation good match
prevent

Enables timely identification, reporting, and patching of the specific input sanitization flaw in firmware V1.1.0.26 to remediate the vulnerability.

AC-3 Access Enforcement good match
prevent

Enforces access control mechanisms to require authentication before allowing access to the vulnerable unauthenticated runtime.macClone endpoint.

References