CVE-2025-9528

What it actually does

The flaw permits unauthenticated remote injection of operating system commands by supplying crafted input to the command argument processed by the systemCommand function at /goform/systemCommand, resulting in arbitrary command execution with the privileges of the web server process.

Why it matters to the business

Attackers can gain remote control of affected routers, enabling network traffic interception, device takeover, or use as a pivot point into connected networks; the high exploit probability and public disclosure after nearly 400 days without a vendor fix increase urgency for organizations relying on these devices.

How an attack unfolds

An attacker sends an HTTP POST request to the /goform/systemCommand endpoint, embedding malicious shell commands in the command parameter; because the input is passed directly to the underlying system shell without sanitization, the commands execute on the device, allowing further actions such as file manipulation or network reconnaissance.

How to fix it

Replace affected devices with supported models or apply any future vendor firmware updates when released; immediately restrict remote management access via firewall rules or disable the web interface entirely if not required.

How to confirm the fix worked

Confirm exposure by testing whether the /goform/systemCommand endpoint accepts and executes injected commands without authentication; after mitigation, verify that administrative interfaces are no longer reachable from untrusted networks and review device logs for prior anomalous requests.

Typical attack path

1. Identify exposed Linksys E1700 devices via internet scanning or internal network discovery
2. Issue a crafted HTTP request to /goform/systemCommand containing OS commands in the command field
3. Execute commands to verify control, such as reading configuration files or establishing reverse shells
4. Pivot to additional targets on the LAN or maintain persistence on the compromised router

How to detect it

Examine web server and router logs for POST requests to /goform/systemCommand containing suspicious command parameters; correlate with unusual outbound connections or process executions originating from the device after the request timestamp.

• POST /goform/systemCommand
• command=.*[;&|`$]
• systemCommand endpoint access without prior authentication

What your security team should do

• Immediately block external access to router administrative interfaces and monitor for internal exploitation attempts
• Inventory all Linksys E1700 deployments and prioritize replacement given the absence of patches and sustained high EPSS score
• Add network segmentation and least-privilege controls around legacy router management traffic