CVE-2026-121931: Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument tracerouteip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely with no user interaction, but the vector indicates that the attacker needs high privileges. Exploitation involves manipulating the traceroute_ip argument handled by apply.cgi in the Traceroute Diagnostic Function.
Which deployments are affected?
The affected product identified is Linksys WRT54GL version 4.30.18. The disclosure states that affected products are no longer supported by the maintainer.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What mitigation is available if a vendor patch is not provided?
The provided information does not identify a patch or workaround. Since the vendor did not respond and the product is unsupported, organizations should treat continued use of the affected device as a risk requiring replacement or removal from exposed network paths.