{"id":"CVE-2026-108896","published":"2026-10-12T15:17:07.423","lastModified":"2026-10-15T16:17:39.187","description":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys3/vuln_70/70.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108896","tags":[]},{"url":"https://vuldb.com/submit/973115","tags":[]},{"url":"https://vuldb.com/vuln/416683","tags":[]},{"url":"https://vuldb.com/vuln/416683/cti","tags":[]},{"url":"https://www.linksys.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys3/vuln_70/70.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in Linksys E1700 routers that allows remote attackers to execute arbitrary OS commands with elevated privileges. This flaw is particularly dangerous because it can be exploited without authentication and affects critical network configuration functions.","exploitability":"The exploit is highly practical with no authentication required, leveraging a publicly available exploit that directly targets the vulnerable setLinksysIpv6 function through the /goform/setLinksysIpv6 endpoint.","blast_radius":"The vulnerability could impact thousands of Linksys E1700 routers globally, potentially allowing attackers to gain full remote control of affected devices and use them as launching points for further network attacks.","remediation":"Upgrade to firmware version 1.0.0.4.004 or later immediately, as this specific version contains the patched implementation of the setLinksysIpv6 function that resolves the command injection vulnerability.","detection":"Monitor for unusual POST requests to /goform/setLinksysIpv6 endpoint with suspicious command injection payloads in _6rd_prefix or _6rd_prefix_len parameters, and watch for unexpected process execution patterns on affected routers.","tags":["rce","remote","network","router"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:55.675Z"}}