CVE-2026-108894
Received Received - Intake

Command Injection in Linksys E1700 Router Firmware

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108894
EUVD
EUVD-2026-97436

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys E1700 1.0.0.4.003

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the Linksys E1700 router version 1.0.0.4.003. It exists in the Static Route Handler component, specifically in the addStaticRoute function. Attackers can manipulate parameters like staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting to inject and execute arbitrary operating system commands. The exploit is publicly available, increasing the risk of attacks.

Detection Guidance

Check for unauthorized static route modifications via the vulnerable endpoint /goform/addStaticRoute. Monitor network traffic for unexpected command execution attempts or unusual route changes. Inspect logs for POST requests to this endpoint with suspicious parameters.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your router. This could lead to unauthorized access, data theft, network compromise, or disruption of services. Since the exploit is public, attackers may actively target vulnerable devices to gain control, monitor traffic, or launch further attacks within your network.

Compliance Impact

This vulnerability enables remote command execution, allowing attackers to gain full control of the device. Such unauthorized access could lead to data breaches, unauthorized data access, or manipulation, which directly violates compliance requirements under GDPR (data protection) and HIPAA (health data security).

Mitigation Strategies

Disable remote access to the router's web interface if possible. Block external access to /goform/addStaticRoute. Update firmware if a patch is released. Monitor for unusual activity and restrict administrative access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart