CVE-2025-45489
Published: 06 May 2025
Summary
CVE-2025-45489 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Linksys E5600 firmware version 1.1.0.26 contains a command injection vulnerability (CWE-77) in the runtime.ddnsStatus DynDNS function, specifically through improper handling of the hostname parameter. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and full impact on confidentiality, integrity, and availability.
Unauthenticated remote attackers can supply a crafted hostname value to the affected DynDNS endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants complete control over the router, enabling actions such as configuration changes, traffic interception, or persistence mechanisms.
Public proof-of-concept code demonstrating the injection has been published, and the EPSS score currently stands at 0.0811 with no material increase observed since disclosure. No vendor advisory or patch information is referenced in available materials.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13616
Vulnerability details
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.