Deviceways

Router

Linksys E900

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Broadcom BCM53572
Retired support documentedOpen device guide
v1; Broadcom BCM5357C0
Open hardware record
Original project github.com

Recorded configuration: 8 MB flash; 32 MB RAM

Device support in source
Retired; check the documented hardware and older release resources.
Limitations
WiFi 2.4GHz
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

linksys e900 v1 — device documentation (github.com)Device details — v1 — Source documentation (openwrt.org)

Hardware revision
v1

OpenWrt · Broadcom BCM53572

OpenWrt · Broadcom BCM53572 — v1 — Source documentation (openwrt.org)

Availability recorded by source
Discontinued

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 10.0 (v4.0)

E900 v1

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

CVE-2025-34037

Affected firmware
Before 1.0.04
Fix
Fix details in the linked record
Read VulnCheck CVE record
Details and sources
Public disclosure CVE updated

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

Security advisory linksys routers command injection — E900 v1 (vulncheck.com) ↗
Check more security advisories for this device · CVE.org