Command Injection Vulnerability in Linksys E5600 Router
CVE-2025-29226

6.3MEDIUM

Key Information:

Vendor

Linksys
Status
Linksys E5600
Vendor
CVE Published:
21 March 2025

What is CVE-2025-29226?

The Linksys E5600 router version V1.1.0.26 contains a command injection vulnerability located in the runtime.pingTest function within the '/usr/share/lua/runtime.lua' file. An attacker can exploit this vulnerability by sending crafted requests that manipulate the 'pt["count"]' parameter, potentially allowing unauthorized command execution. This may compromise the integrity and security of the device, enabling attackers to access sensitive system features or perform unintended actions.

References

https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.