CVE-2025-29230

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md	Broken Link

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:linksys:e5600_firmware:1.1.0.26:*:*:*:*:*:*:*

cpe:2.3:h:linksys:e5600:-:*:*:*:*:*:*:*

History

01 Apr 2025, 20:28

Type	Values Removed	Values Added
CPE		cpe:2.3:h:linksys:e5600:-:::::::* cpe:2.3:o:linksys:e5600_firmware:1.1.0.26:::::::*
References	~~() https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md -~~	() https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md - Broken Link
First Time		Linksys e5600 Linksys Linksys e5600 Firmware
Summary		(es) Se descubrió que el Linksys E5600 v1.1.0.26 contiene una vulnerabilidad de inyección de comandos en la función runtime.emailReg. Esta vulnerabilidad puede activarse mediante el parámetro `pt["email"]`.

21 Mar 2025, 18:15

Type	Values Removed	Values Added
CWE		CWE-77
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.6

21 Mar 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-21 17:15

Updated : 2025-04-01 20:28

NVD link : CVE-2025-29230

Mitre link : CVE-2025-29230

CVE.ORG link : CVE-2025-29230

JSON object : View

Products Affected

linksys

e5600
e5600_firmware

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

8.6 /10