CVE-2025-29230
Published: 21 March 2025
Summary
CVE-2025-29230 is a high-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Linksys E5600 firmware version 1.1.0.26 contains a command injection vulnerability (CWE-77) in the runtime.emailReg function that is triggered by unsanitized input in the pt["email"] parameter. The flaw received a CVSS 3.1 score of 8.6 with a network attack vector, low attack complexity, and no authentication or user interaction requirements.
An unauthenticated remote attacker can send a crafted request to the affected device and execute arbitrary commands, resulting in high-integrity impact along with limited confidentiality and availability consequences.
The EPSS score rose from a low baseline to a recorded peak of 0.0103, indicating emerging exploitation interest after public disclosure. The sole reference is a technical write-up hosted on GitHub that details the injection point but provides no vendor patch or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7230
Vulnerability details
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router web interface directly enables T1190 (Exploit Public-Facing Application) for unauthenticated network access and T1059.004 (Unix Shell) for arbitrary command execution on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the pt[email] parameter to block command injection in the runtime.emailReg function.
Mandates timely remediation of identified flaws, such as patching the command injection vulnerability in Linksys E5600 firmware v1.1.0.26.
Enforces boundary protections to control network access to the vulnerable runtime.emailReg endpoint, mitigating unauthenticated remote exploitation.