CVE-2025-45490
Published: 06 May 2025
Summary
CVE-2025-45490 is a critical-severity Command Injection (CWE-77) vulnerability in Linksys E5600 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Linksys E5600 firmware version 1.1.0.26 contains a command injection vulnerability, tracked as CVE-2025-45490, in the runtime.ddnsStatus DynDNS function that processes the password parameter. The flaw is classified under CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
An unauthenticated remote attacker can supply a crafted password value to the affected DynDNS endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, consistent with the high-impact metrics in the CVSS vector.
Public proof-of-concept code and a detailed technical write-up are available on GitHub, but no vendor advisory, patch information, or mitigation guidance is referenced in the supplied sources. The EPSS score remains flat at 0.0811 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13617
Vulnerability details
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.