{"id":"CVE-2026-121932","published":"2026-11-04T19:17:33.440","lastModified":"2026-11-04T19:17:33.623","description":"A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Zimo-666/E5350-cves/tree/main/01-wizard-preauth-command-injection","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121932","tags":[]},{"url":"https://vuldb.com/submit/1024275","tags":[]},{"url":"https://vuldb.com/submit/1024277","tags":[]},{"url":"https://vuldb.com/vuln/431044","tags":[]},{"url":"https://vuldb.com/vuln/431044/cti","tags":[]},{"url":"https://www.linksys.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Zimo-666/E5350-cves/tree/main/01-wizard-preauth-command-injection","tags":[]}],"hasPoc":true,"ai":{"summary":"The Linksys E5350 router's /wizard/apply.cgi endpoint allows unauthenticated remote attackers to inject and execute arbitrary OS commands via the ping_ip or traceroute_ip parameters due to insufficient input sanitization in the 'system' function, leading to full device compromise.","exploitability":"Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible over HTTP.","blast_radius":"Successful exploitation grants full root-level control of the router, enabling persistent network surveillance, man-in-the-middle attacks, lateral movement, and potential disruption of all connected devices.","remediation":"Upgrade to firmware version 1.0.00.038 or later if available; if no patched version is published by the vendor (as indicated by lack of response), disable the wizard/apply.cgi endpoint and restrict access to management interfaces via network segmentation or firewall rules.","detection":"Look for HTTP POST requests to /wizard/apply.cgi containing suspicious shell metacharacters (e.g., ';', '|', '$(', backticks) or known command sequences (e.g., 'ping -c 1 127.0.0.1; whoami') in the ping_ip or traceroute_ip parameters in web access logs.","tags":["rce","web","router","os-command-injection","no-auth","public-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:43:32.968Z"}}