CVE-2025-29230
Published: 21 March 2025
Summary
CVE-2025-29230 is a high-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of untrusted inputs like the pt[email] parameter to block command injection in the runtime.emailReg function.
Mandates timely remediation of identified flaws, such as patching the command injection vulnerability in Linksys E5600 firmware v1.1.0.26.
Enforces boundary protections to control network access to the vulnerable runtime.emailReg endpoint, mitigating unauthenticated remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router web interface directly enables T1190 (Exploit Public-Facing Application) for unauthenticated network access and T1059.004 (Unix Shell) for arbitrary command execution on the device.
NVD Description
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
Deeper analysisAI
CVE-2025-29230 is a command injection vulnerability (CWE-77) in the Linksys E5600 router firmware version 1.1.0.26. The issue exists in the runtime.emailReg function, which can be triggered via the pt["email"] parameter, allowing injection of malicious commands.
With a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Attackers can achieve high integrity impact through arbitrary command execution, alongside low confidentiality and availability impacts, potentially leading to full device compromise.
Mitigation details are available in the referenced advisory at https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md, published on 2025-03-21.
Details
- CWE(s)