The vulnerability is a command injection flaw in the /tmUnblock.cgi and /hndUnblock.cgi endpoints of E-Series Linksys routers. When a user supplies a ttcp_ip parameter over HTTP on port 8080, the input is passed directly to the shell without sanitization, allowing unauthenticated attackers to inject arbitrary shell commands. The flaw enables remote code execution, as demonstrated by the 2014 TheMoon worm and recent evidence from Shadowserver.

Affected models include Linksys E1000 v1, E1200 v1, E1500 v1, E1550, E2000, E2100L v1, E2500 v1/v2, E3000, E3200, E4200, and E900 v1. Other Linksys products such as WAG, WAP, WES, WET, WRT series routers and Wireless‑N access points may also be impacted. The vulnerability is specific to the HTTP interface on port 8080.

The CVSS score of 10 and an EPSS score of 89% indicate a critical flaw that is highly likely to be actively exploited. Exploitation is simple: the attacker only needs to send a crafted HTTP request to the vulnerable endpoint from outside the local network. The vulnerability is not yet listed in the CISA KEV catalog, but monitoring reports show recent activity in February 2025.