Command Injection Vulnerability in Linksys FGW3000 Series

CVE-2025-4999

What is CVE-2025-4999?

A command injection vulnerability exists in the Linksys FGW3000-AH and FGW3000-HK devices, specifically in the HTTP POST request handler at sub_4153FC of the sysconf.cgi file. This flaw arises from improper handling of the supplicant_rnd_id_en argument, which could allow an attacker to execute arbitrary commands on the affected device remotely. With public disclosure of the exploit, users of these devices may be at risk if they do not apply the necessary security measures. Immediate attention is recommended to safeguard against potential exploitation.

References