CVE-2025-45489

The vulnerability results from insufficient validation and sanitization of input data passed through the hostname parameter to the runtime.ddnsStatus function handling the DynDNS service. An attacker can inject malicious system commands into this parameter, which will be executed directly by the device's operating system. The attack vector is network-based, requires no authentication or user interaction, making exploitation particularly straightforward.

Successful exploitation of the vulnerability allows an attacker to gain full control over the device — execute arbitrary commands with system privileges, read and modify configuration, and potentially use the router as an entry point to the local network.

Apply patches available from the manufacturer according to the references. As interim measures, it is recommended to restrict access to the device management interface to trusted hosts only and disable the DynDNS function if not in use.

Linksys E5600 with firmware version v1.1.0.26