This command injection vulnerability in the ipsec_conn interface affects nine models split across two firmware lineages: WR1500, WR3600, and WR6500 remain on 2.3.x branches, while the other six models run 2.4.x versions ranging from 2.4.15 through 2.4.25. The version spread is analytically significant — it suggests either a shared component propagated inconsistently across product lines, or the vulnerability predates the branch split and was carried forward without remediation. Either way, you're not looking at nine independent vulnerabilities; you're looking at one flaw that touched nine devices.
The CVSS 9.8 is technically accurate for command injection with root-level execution, but the EPSS of 0.02619 reflects a specific precondition: IPsec is not typically enabled by default on consumer routers, and when it is enabled, it may not be WAN-exposed. Your first priority is determining whether ipsec_conn is reachable from the internet or requires an authenticated LAN session. If it's the former, this is an unauthenticated remote vector and warrants emergency patching. If it's the latter, the severity drops to a lateral movement concern.
The version history tells a worrying story. The 2.4.15-through-2.4.25 range means this flaw survived at least ten subsequent patch releases on some devices — the maintenance process ran multiple iterations without surfacing the vulnerability. The three devices stuck on 2.3.x are likely in a maintenance vacuum with no incoming security updates, meaning those specific models may never receive a patch.
Check your device's current firmware version immediately. If you're running any affected version, disable IPsec if you don't need it. If you do need IPsec, isolate the device behind a firewall and monitor for any anomalous VPN traffic patterns. The CVSS score will matter less than whether your deployment exposes this interface to untrusted networks.