{"id":"CVE-2026-121933","published":"2026-11-04T20:19:11.607","lastModified":"2026-11-04T20:19:11.813","description":"A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Zimo-666/E5350-cves/tree/main/02-empty-admin-password-auth-bypass","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121933","tags":[]},{"url":"https://vuldb.com/submit/1024276","tags":[]},{"url":"https://vuldb.com/vuln/431045","tags":[]},{"url":"https://vuldb.com/vuln/431045/cti","tags":[]},{"url":"https://www.linksys.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Zimo-666/E5350-cves/tree/main/02-empty-admin-password-auth-bypass","tags":[]}],"hasPoc":true,"ai":{"summary":"The Linksys E5350 router’s Setup Wizard endpoint `/wizard/apply.cgi` lacks authentication for the `save_settings` function, allowing remote attackers to modify critical settings—including the admin password—by manipulating the `wizard_router_pwd` argument.","exploitability":"Trivial to exploit; no authentication or user interaction required, and a public exploit exists.","blast_radius":"Complete device compromise is possible: an attacker can reset the admin password, reconfigure network settings, and potentially pivot to other internal devices.","remediation":"Upgrade to firmware version 1.0.00.038 or later, as the vendor confirmed a fix was released after early disclosure but did not respond further; until then, disable the Setup Wizard endpoint by blocking access to `/wizard/apply.cgi` and restrict management access to trusted LAN IPs.","detection":"Look for POST requests to `/wizard/apply.cgi` with `wizard_router_pwd` parameter in logs of the router’s web server or any upstream reverse proxy; repeated or anomalous password-change attempts without prior admin login are highly suspicious.","tags":["auth-bypass","web","firmware","iot"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:43:43.683Z"}}