Unauthorized Access Risk in Linksys E2500 by Vendor Linksys
CVE-2025-44654

9.8CRITICAL

Key Information:

Vendor

Linksys
Status
E2500
Vendor
CVE Published:
21 July 2025

What is CVE-2025-44654?

The Linksys E2500 router version 3.0.04.002 has a security flaw stemming from the enabled chroot_local_user option within its vsftpd configuration file. This configuration oversight can facilitate unauthorized access to sensitive system files, potentially allowing attackers to escalate privileges. Furthermore, such a vulnerability could enable the compromised device to act as a pivot point for executing internal network attacks, thereby raising serious concerns regarding network integrity and security.

References

http://e2500.com
https://gist.github.com/TPCchecker/279708bf9c599c836ea66f...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.