This vulnerability (CVE-2025-34037) involves OS command injection in Linksys E-Series routers through the /tmUnblock.cgi and /hndUnblock.cgi endpoints on HTTP port 8080. The CGI scripts fail to sanitize the ttcp_ip parameter, permitting unauthenticated attackers to execute arbitrary shell commands. Exploitation is confirmed in the wild by the "TheMoon" worm, which uses this vector to deploy a MIPS ELF payload for arbitrary code execution. The vulnerability potentially affects multiple Linksys router and access point models beyond the E-Series. No official patch or vendor advisory is currently provided, and affected versions are not explicitly stated.

Successful exploitation allows unauthenticated attackers to execute arbitrary OS commands on vulnerable Linksys routers, leading to full compromise of the device. This enables attackers to deploy malicious payloads such as the MIPS ELF payload used by the "TheMoon" worm, potentially resulting in device takeover, network disruption, or use in botnets. The vulnerability affects router functionality and network security integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's HTTP port 8080 interface from untrusted networks to reduce exposure. Monitor for unusual network activity indicative of exploitation attempts. Avoid exposing the affected endpoints to the internet.