CVE-2026-121932: Linksys E5350 apply.cgi system os command injection
A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument pingip/tracerouteip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices identified as Linksys E5350 running version 1.0.00.037 are affected. The issue can be exploited remotely over the network.
What does an attacker need to exploit it?
No privileges or user interaction are required. An attacker can manipulate the ping_ip or traceroute_ip argument handled by /wizard/apply.cgi to inject operating-system commands.
How urgent is remediation?
The issue is rated critical with a 9.3 score, and public exploit code is available. The vendor was contacted but did not respond, so organizations should treat exposed affected devices as high priority.