CVE-2026-121931
Deferred Deferred - Pending Action

Command Injection in Linksys WRT54GL Router

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulDB

Description
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121931
EUVD
EUVD-2026-117047

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys WRT54GL 4.30.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated OS command injection flaw in the Linksys WRT54GL router's Traceroute diagnostic function. It allows attackers to inject arbitrary commands via the traceroute_ip parameter in the web management interface. The flaw exists due to insufficient input validation, enabling bypass of a weak blacklist filter. Exploitation requires authentication and an active WAN link.

Detection Guidance

Check if your Linksys WRT54GL is running firmware version 4.30.18 build 006. Inspect web interface logs for unusual traceroute_ip parameter values. Test with authenticated requests containing command injection payloads like ';id' or '&&id' in the traceroute_ip field.

Impact Analysis

An attacker could exploit this to execute arbitrary commands with root privileges on the device. This may lead to full device compromise, including configuration changes, traffic interception, and installation of persistent backdoors. The attack is limited to about 30 bytes per payload but can still be used for significant damage.

Mitigation Strategies

Since the device is end-of-life and unsupported, the only reliable mitigation is to disconnect the WRT54GL from the network or replace it with a supported router. Disable remote administration and restrict physical access to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...