This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) in various Linksys E-Series routers, specifically the E4200 model. The affected CGI scripts (/tmUnblock.cgi and /hndUnblock.cgi) accept user input via the ttcp_ip parameter without proper sanitization, enabling unauthenticated remote attackers to inject arbitrary shell commands. Exploitation has been observed in the wild, notably by the "TheMoon" worm in 2014, which used this flaw to execute a MIPS ELF payload on vulnerable devices. The vulnerability may also affect other Linksys router and access point models in the WAG, WAP, WES, WET, and WRT series. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security controls. No patch or official remediation guidance is currently provided.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on affected Linksys routers, leading to full compromise of the device. This can result in complete loss of confidentiality, integrity, and availability of the router, enabling attackers to deploy malware, disrupt network operations, or use the device as a foothold for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's HTTP management interface on port 8080 from untrusted networks. Disable or block access to the /tmUnblock.cgi and /hndUnblock.cgi endpoints if possible. Monitor for unusual network activity indicative of exploitation attempts.