CVE-2026-121932
Deferred Deferred - Pending Action

Command Injection in Linksys E5350 Router

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulDB

Description
A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121932
EUVD
EUVD-2026-117050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys E5350 1.0.00.037

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication OS command injection flaw in Linksys E5350 firmware v1.0.00.037. It occurs during the factory or setup-wizard state, where the device is accessible without authentication. The vulnerability allows remote attackers to execute arbitrary commands as root by manipulating the ping_ip or traceroute_ip parameters in the /wizard/apply.cgi URL. The attack works because these parameters are passed unsanitized to the system() function.

Detection Guidance

Check if your Linksys E5350 router is running firmware version v1.0.00.037. During the factory or setup-wizard state, test if the URL /wizard/apply.cgi is accessible without authentication. Send a crafted POST request to /wizard/apply.cgi with parameters like ping_ip or traceroute_ip containing shell metacharacters to see if arbitrary commands execute. Look for unexpected files like /tmp/e5350_pwned2.

Example command to test: curl -X POST -d 'ping_ip=1.1.1.1; touch /tmp/e5350_pwned2' http://<router-ip>/wizard/apply.cgi. If the file appears, the device is vulnerable.

Impact Analysis

This vulnerability allows attackers on the same network (LAN or WAN during setup) to fully compromise the device. They can execute any command as root, install malware, steal data, or use the device as a pivot point for further attacks. The attack is persistent and remains active even after initial setup, as the flaw is in the firmware itself.

Mitigation Strategies

Disable access to the setup-wizard state by completing the initial setup and setting a strong admin password. Disable remote administration if enabled. Update the router firmware to the latest version if a patch is available. Block external access to the router's web interface.

If immediate patching is not possible, isolate the router from untrusted networks and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...