CVE-2025-9528

low · 2

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS

54.2%

EPSS (exploit prob.)

99th

EPSS percentile

2025-08-27

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-77CWE-78

Affected products

Vendor	Product	Affected versions
linksys	e1700_firmware	1.0.0.4.003
linksys	e1700	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_61/61.md
https://github.com/wudipjq/my_vuln/blob/main/Linksys2/vuln_61/61.md#poc
https://vuldb.com/?ctiid.321545
https://vuldb.com/?id.321545
https://vuldb.com/?submit.634827
https://www.linksys.com/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-9528