CVE-2025-45489

published 2025-05-06

CVE-2025-45489: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
linksys	e5600_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://github.com/JZP018/vuln03/blob/main/linksys/E5600

path /API/obj

version Linksys E5600 v1.1.0.26↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Linksys E5600 runtime.ddnsStatus Multiple Parameters Command Injection Attempt (CVE-2025-45488-2025-45491)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:8; content:"/API/obj"; http.header_names; to_lowercase; content:"|0d 0a|cookie|0d 0a|"; http.request_body; content:"|22|DdnsP|22|"; fast_pattern; pcre:"/\x22(?:hostname|mailex|username|password).*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|(?:\x26{2}|%26%26))+/"; reference:cve,2025-45488; reference:cve,2025-45489; reference:cve,2025-45490; reference:cve,2025-45491; reference:url,github.com/JZP018/vuln03/blob/main/linksys/E5600; classtype:attempted-admin; sid:2062421; rev:1; metadata:affected_product Linksys, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_05_19, cve CVE_2025_45488, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|22|DdnsP|22|

bytes

|0d 0a|cookie|0d 0a|

• → Exploit targets HTTP POST requests to the exact 8-byte URI /API/obj on the Linksys E5600 management interface.
• → Request body must contain the DdnsP keyword (hex |22|DdnsP|22|), indicating a DynDNS profile object manipulation call to runtime.ddnsStatus.
• → Command injection payload is injected into one of four parameters — hostname, mailex, username, or password — using shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), dollar sign ($/%24), or double-ampersand (&&/%26%26).
• → A Cookie header must be present in the request, suggesting authentication is required before exploitation (session cookie needed).
• → Traffic is plaintext (non-TLS); deploy detection at the network perimeter and internally.
• → CVE-2025-45489 is part of a cluster of four related command injection CVEs (CVE-2025-45488 through CVE-2025-45491) all targeting the same endpoint and function on the Linksys E5600.

• · The Snort/Suricata rule (sid:2062421) covers all four CVEs (45488–45491) in a single signature; triggering on this rule does not isolate CVE-2025-45489 specifically — triage must inspect which parameter (hostname for -45489) carries the injection payload.
• · The rule requires a Cookie header to be present, meaning unauthenticated probes without a session cookie will not match — adjust if pre-auth exploitation paths are discovered.
• · The URI match uses a strict byte-size constraint (bsize:8) for /API/obj; any URL-encoding or path variation would evade this check.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77