{"id":"CVE-2026-121930","published":"2026-11-04T19:17:32.883","lastModified":"2026-11-04T19:17:33.087","description":"A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Zimo-666/WRT54GL-cves/tree/main/CVE-TBD-ping-ip-command-injection","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121930","tags":[]},{"url":"https://vuldb.com/submit/1024098","tags":[]},{"url":"https://vuldb.com/vuln/431042","tags":[]},{"url":"https://vuldb.com/vuln/431042/cti","tags":[]},{"url":"https://www.linksys.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Zimo-666/WRT54GL-cves/tree/main/CVE-TBD-ping-ip-command-injection","tags":[]}],"hasPoc":true,"ai":{"summary":"The Linksys WRT54GL router's ping diagnostic feature allows remote OS command injection via the ping_ip parameter in apply.cgi due to insufficient input sanitization, enabling authenticated attackers to execute arbitrary commands on the device.","exploitability":"Exploitation requires valid admin credentials and network access to the web interface; the public exploit makes it trivial for attackers with those credentials.","blast_radius":"Successful exploitation grants full control of the router, allowing attackers to intercept traffic, pivot into internal networks, or disrupt connectivity.","remediation":"Upgrade to firmware version 4.30.19 or later if available; otherwise, disable the Ping Diagnostic feature and restrict access to apply.cgi to trusted management networks only.","detection":"Look for HTTP POST requests to /apply.cgi containing suspicious shell metacharacters (e.g., ';', '|', '&') in the ping_ip parameter, especially from non-admin IP addresses or at unusual times. Also monitor for unexpected processes like 'ping' spawning additional commands in system logs.","tags":["os-command-injection","router","web-interface","authenticated","legacy-device"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:48:20.835Z"}}