CVE-2025-45487
Published: 06 May 2025
Summary
CVE-2025-45487 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Linksys E5600 firmware version 1.1.0.26 contains a command injection vulnerability in the runtime.InternetConnection function, classified under CWE-77. The issue carries a CVSS 3.1 score of 9.8 reflecting network attack vector, low complexity, and no required privileges or user interaction, allowing an attacker to supply crafted input that is executed by the underlying system shell.
An unauthenticated remote attacker can reach the affected function over the network and achieve arbitrary command execution, resulting in complete control over device confidentiality, integrity, and availability. Public proof-of-concept code demonstrating the injection has been published, confirming the flaw is reproducible on the stated firmware.
The EPSS score remains flat at 0.0816 with no material increase after disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13614
Vulnerability details
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.