Command Injection Vulnerability in Linksys E5600 by Linksys
CVE-2025-29227

6.3MEDIUM

Key Information:

Vendor
Linksys
Status
E5600
Vendor
CVE Published:
21 March 2025

Summary

The Linksys E5600 version V1.1.0.26 is impacted by a command injection vulnerability located in the runtime.pingTest function of the runtime.lua file. This vulnerability can be exploited through a crafted request utilizing the pt["pkgsize"] parameter, allowing attackers to execute arbitrary commands on the affected device. It is crucial for users of the Linksys E5600 to take precautions and apply necessary updates to mitigate potential risks.

References

https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.