CVE-2025-34037

This exploit targets an unauthenticated remote code execution vulnerability in various Linksys routers by leveraging a command injection flaw in the tmUnblock.cgi endpoint. It writes a MIPSEL shellcode payload to the filesystem and executes it to establish a bind shell on port 4444.

This repository contains a functional Python exploit for CVE-2025-34037, targeting a command injection vulnerability in the tmUnblock.cgi endpoint of various Linksys router models. The exploit stages a MIPS bind shell onto the target device and provides an interactive shell.

This Metasploit module exploits an unauthenticated OS command injection vulnerability in Linksys E-Series routers (CVE-2025-34037), leveraging the 'ttcp_ip' parameter in a POST request to '/tmUnblock.cgi' to execute arbitrary commands. It supports MIPS-based payloads and was tested against E1500 v1.0.5.