Paper/Archive/CVE-2026-121932

CVE-2026-121932

Linksys E5350 — Linksys E5350 apply.cgi system os command injection

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource

E53501.0.00.037–CNA

Scores by source

VulDB (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

VulDB (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

VulDB (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

References

writeupvuldb.com/vuln/431044 refvuldb.com/vuln/431044/cti writeupvuldb.com/cve/CVE-2026-121932 writeupvuldb.com/submit/1024275 writeupvuldb.com/submit/1024277 exploitgithub.com/Zimo-666/E5350-cves/tree/main/01-wizard-preauth-command-injection reflinksys.com