CVE-2025-45489 is a critical command injection flaw (CVSS 9.8) in the Linksys E5600 router on firmware v1.1.0.26. It affects the runtime.ddnsStatus DynDNS function, through the hostname parameter. The record lists no fixed version, so check Linksys for new firmware and turn off remote administration.
What's affected
Per the CVE record, Linksys E5600 firmware v1.1.0.26 contains a command injection vulnerability in the runtime.ddnsStatus DynDNS function, through the hostname parameter. The affected products are the E5600 and its firmware.
This is one of four records that name the same DynDNS function and differ only in the parameter. Fixing one without the others would leave the router open.
The record names no patched firmware. Its references are a PDF and a script file in a public GitHub repository, which I did not retrieve, so do not assume a fix exists. Check the Linksys support page for the E5600 and read the release notes for anything newer than v1.1.0.26.
The vector is network based, low complexity, with no privileges and no user interaction, and high impact across the board. The record reports no attacks in the wild, and the KEV flag is false.
How to check if you're exposed
Sign in to the router's admin page and read the firmware version. If it shows v1.1.0.26, treat the device as affected.
Then check what the internet can reach. Remote management should be off, and no admin port should be forwarded. From a machine on your network, you can test your own router for open admin ports:
nmap -p 80,443,8080 <router-address>
Run this only against devices you own. Then, from a connection outside your network, scan your public address to see whether any admin page answers.
Check the router's dynamic DNS settings as well. If you do not use a DynDNS service, make sure the feature is off and its fields are empty, and remember that turning a feature off in the interface is not proof that the code is gone.
What to do now
- List every Linksys E5600 on your networks, with firmware versions.
- Check the Linksys support site for firmware newer than v1.1.0.26, and install it if it exists.
- Turn off remote administration and any port forwards to the admin interface.
- Turn off dynamic DNS if you do not use it.
- Change the router admin password to a long unique one.
- Keep guest devices and smart home gear on a separate network from work machines.
- If no fix arrives and the router matters, replace it with a model that is still supported.
Why it matters
The record maps the issue to CWE-77. Command injection means a value the user supplies ends up inside a command that the router runs, so the router does what an attacker intends. On this class of device, commands run with high privileges.
Settings like dynamic DNS fields are an old trouble spot. They look harmless, since they are just a hostname and a password, but the firmware passes them to system tools, and a missing check turns each field into a possible way in.
Routers get replaced slowly and updated even more slowly. A short written list of the routers at each site, with their firmware, is the single most useful control against this kind of record.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the software you build, and the Gold directory lets you look up CVEs by vendor.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-45489 being exploited in the wild?
The record does not report exploitation and its CISA KEV flag is false. That can change, so check the CISA catalog again before you decide how urgent this is.
Is there a firmware update for the Linksys E5600?
The record names none. Check Linksys support for the E5600 and read the release notes, and limit access to the admin interface in the meantime.
Sources
- CVE-2025-45489 on Gold
- NVD record for CVE-2025-45489
- References listed in the CVE record: a PDF and a script in a public GitHub repository. They were not retrieved when this post was written.
Last reviewed: 18 October 2026.
