CVE-2025-29228

The vulnerability occurs in the runtime.macClone function, which does not perform proper validation or sanitization of input data passed through the mc.ip parameter. An attacker can inject malicious system commands into this parameter value, which will be executed by the device with the privileges of the process handling the request. The attack is possible remotely over the network without requiring any credentials.

An attacker can gain full control over the device by executing arbitrary system commands — leading to violation of confidentiality, integrity, and availability of the system. It is possible to take over the router, modify network configuration, and use the device as an entry point to the local network.

Apply patches available from the manufacturer according to the references. Until the fix is deployed, it is recommended to restrict access to the device management interface only to trusted hosts and implement network segmentation.

Linksys E5600 with firmware version V1.1.0.26