{"uuid": "1ff32444-738e-4ccd-906b-6522428195f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34037", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/linksys_themoon_exec.rb", "content": "{\"aliases\": [], \"arch\": \"mipsle, mipsbe\", \"author\": [\"Johannes Ullrich\", \"Rew\", \"infodox\", \"Michael Messner \", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command\\n          injection. This vulnerability was used from the so-called \\\"TheMoon\\\" worm. There\\n          are many Linksys systems that are potentially vulnerable, including E4200, E3200, E3000,\\n          E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900. This module was tested\\n          successfully against an E1500 v1.0.5.\", \"disclosure_date\": \"2014-02-13\", \"fullname\": \"exploit/linux/http/linksys_themoon_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Linksys E-Series TheMoon Remote Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/linksys_themoon_exec.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/linksys_themoon_exec\", \"references\": [\"CVE-2025-34037\", \"EDB-31683\", \"BID-65585\", \"OSVDB-103321\", \"PACKETSTORM-125253\", \"PACKETSTORM-125252\", \"URL-https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633\", \"URL-https://isc.sans.edu/forums/diary/Linksys+Worm+TheMoon+Captured/17630\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux mipsel Payload\", \"Linux mipsbe Payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:43.251931Z"}