CVE-2025-45488

An attacker sends a crafted request to the runtime.ddnsStatus function that handles DynDNS configuration, injecting malicious system commands via the mailex parameter. The device does not properly validate the value of this parameter before passing it to the command interpreter, allowing arbitrary commands to be executed in the context of the router's operating system. The attack requires no privileges or user interaction.

An attacker can gain full control over the device by executing arbitrary system commands with the privileges of the process handling the request — which may lead to router compromise, network traffic interception, modification of network configuration, or use of the device as an entry point to the internal network.

Apply patches available from the manufacturer according to the references. Until updates are applied, it is recommended to restrict access to the router's administrative panel exclusively to trusted IP addresses and disable the DynDNS function if it is not being used.

Linksys E5600 with firmware version v1.1.0.26