Deviceways

Router

Linksys E4200

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v1 · Broadcom BCM4331 Wi-Fi
Processor: Broadcom BCM4718A1Open hardware record
v2 · Marvell 88W8063 / Marvell 88W8366 Wi-Fi
Processor: Marvell 88F6282 · Wi-Fi chip: Marvell 88W8063 · Wi-Fi chip: Marvell 88W8366Open hardware record Release listed · 25.12.5
v1.0 · Broadcom BCM4331 / Broadcom BCM4718 Wi-Fi
Get OpenWrt firmware Release listed · 25.12.6
v2 · 2x Marvell 88W8366 Wi-Fi
Get OpenWrt firmware Release listed · 25.12.6
v2
Get firmware Release listed · 25.12.5
v1.0 · Broadcom BCM4718
Open hardware record
v2
Open hardware record Release listed · 25.12.5
Original project github.com

v1.0 · Broadcom BCM4331 / Broadcom BCM4718 Wi-Fi

Limitations
WiFi 5GHz
First installation
GUI OEM; CLI generic; Linksys TFTP; see forum

v2 · 2x Marvell 88W8366 Wi-Fi

Limitations
WPA3
First installation
GUI OEM
Sources
Replacement firmware

Replace supported router software with a community system for network management and add-on packages.

Applies tov1

How to get started

Follow the project’s Linksys flashing guidance and the hardware-row notes before choosing an initial image.

Setup
Firmware replacement
You’ll need
E4200 v1 only; the project explicitly excludes v2.
Original project wiki.freshtomato.org

Features & details

Check the project and hardware shown for each feature.

Device details

linksys e4200 v1 — device documentation (github.com)Device details — v1 — Source documentation (openwrt.org)

Hardware revision
v1.0

Device details

linksys e4200 v2 — device documentation (github.com)Linksys E4200 v2 — WikiDevi (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
v2

Device details

Linksys E4200 v1 — TechInfoDepot (github.com)

Hardware revision
v1

Device details

Linksys E4200 v2 — TechInfoDepot (github.com)

Hardware revision
v2

Device details

Linksys E4200 v1 — WikiDevi (github.com)

Hardware revision
v1

OpenWrt · v1.0 · Broadcom BCM4331 / Broadcom BCM4718 Wi-Fi

OpenWrt · v1.0 · Broadcom BCM4331 / Broadcom BCM4718 Wi-Fi — v1 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM, CLI generic, Linksys TFTP, see forum
Recovery routes recorded
TFTP generic, GUI generic, CLI generic, see forum
Availability recorded by source
Discontinued

OpenWrt · v2 · 2x Marvell 88W8366 Wi-Fi

OpenWrt · v2 · 2x Marvell 88W8366 Wi-Fi — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM
Availability recorded by source
Discontinued

Hardware differences

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 10.0 (v4.0)

E4200

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

CVE-2025-34037

Affected firmware
Before 1.0.06
Fix
Fix details in the linked record
Read VulnCheck CVE record
Details and sources
Public disclosure CVE updated

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Security advisory linksys routers command injection — E4200 (vulncheck.com) ↗
CVE published

Linksys E4200

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the (1)…

CVE-2013-2679

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
Public disclosure CVE updated

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the (1) log_type, (2) ping_ip, (3) ping_size, (4) submit_type, or (5) traceroute_ip parameter to apply.cgi or (6) new_workgroup or (7) submit_button parameter to storage/apply.cgi.

CVE published

Linksys E4200

Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-2684

Affected firmware
E4200: 1.0.05 Build 7
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
Public disclosure CVE updated

Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

84070 — Linksys E4200 (exchange.xforce.ibmcloud.com) ↗
CVE published

Linksys E4200

Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitive information.

CVE-2013-2683

Affected firmware
E4200: 1.0.05 Build 7
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
Public disclosure CVE updated

Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitive information.

84067 — Linksys E4200 (exchange.xforce.ibmcloud.com) ↗
CVE published

Linksys E4200

Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.

CVE-2013-2682

Affected firmware
E4200: 1.0.05 Build 7
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
Public disclosure CVE updated

Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.

84071 — Linksys E4200 (exchange.xforce.ibmcloud.com) ↗
Check more security advisories for this device · CVE.org