{"id":"CVE-2026-121930","kind":"vulnerability","aliases":["CVE-2026-121930"],"related":[],"title":"Linksys WRT54GL router: ping diagnostic lets remote users run OS commands","description":"A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Linksys WRT54GL 4.30.18 passes the ping_ip parameter of apply.cgi (Ping Diagnostic) to a system shell without sanitising it, so an authenticated user of the web admin can run OS commands on the router. A public proof of concept exists (linked from VulDB; not retrieved). The model is end of life and the vendor did not respond.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WRT54GL","fixed":[],"affected":"4.30.18","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","end-of-life","home-router","infrastructure","linksys","wrt54gl"],"not_affected_if":["other-models","remote-management-disabled","web-admin-not-exposed"],"how_to_check":"- Admin page > Status: firmware version 4.30.18 on a WRT54GL is the affected combination.\n- Exploitation needs a logged-in admin session (CVSS vector PR:H; VulDB: further authentication required), so check that the admin password is not the default (admin/admin or admin/password are common on this model) and that remote management / port-forwarding to the router's web admin is off.\n- Also check any other WRT54GL firmware you run; only 4.30.18 is named.","fix":"No fix: end-of-life model, vendor did not respond to the disclosure (VulDB). Replace the router; until then disable remote management and change the default admin password.","status":"open","published_at":"2026-11-04T19:17:32+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:06+00:00","updated_at":"2026-11-04T19:31:24+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-04T19:30:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys WRT54GL router: ping diagnostic lets remote users run OS commands","impact":"high","summary":"The Linksys WRT54GL 4.30.18 web interface passes the ping_ip parameter of apply.cgi to a system shell without checking it. A remote attacker can inject operating system commands and run them on the router.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linksys","wrt54gl","home-router","end-of-life"],"confidence":0.7,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs commands on the router remotely","analyst_note":"Confirm whether the web admin is exposed by default and whether the flaw needs a logged-in session; check the NVD page for the attack vector details.","how_to_check":"- Check the router's firmware version in its admin page under Status; the affected version is `4.30.18`.\n- Check whether the router's web admin is reachable from the internet, for example by port-forwarding or remote management settings.\n- Check whether the router still receives security updates from the maintainer; the description says it does not.","plain_action":"","needs_analyst":true,"not_affected_if":["other-models","web-admin-not-exposed"],"who_is_affected":"Only the WRT54GL router running firmware 4.30.18 is named in the sources, and the description says this product is no longer supported by its maintainer. Any such router with its web interface reachable from an untrusted network is exposed. Teams that do not run this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000701,"input_tokens":4170,"output_tokens":568,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the web admin is exposed by default and whether the flaw needs a logged-in session; check the NVD page for the attack vector details.","search":"'-121930':14A,17A '-2026':13A,16A '4.30.18':32B,95C 'admin':56B 'affect':97C,162C 'apply.cgi':39B,106C 'argument':116C 'attack':124C,143C 'authent':19B,51B 'avail':134C 'caus':119C 'command':11A,60B,121C 'compon':109C 'concept':68B 'contact':147C 'could':139C 'cve':12A,15A 'diagnost':5A,41B,111C 'disclosur':151C 'earli':148C 'element':98C 'end':21B,78B 'end-of-lif':20B 'exist':69B 'exploit':130C 'file':105C 'function':101C 'home':25B 'home-rout':24B 'identifi':91C 'infrastructur':27B 'initi':127C 'inject':122C 'ip':36B,118C 'let':6A 'life':23B,80B 'link':70B 'linksi':1A,28B,30B,93C 'longer':167C 'made':133C 'maintain':171C 'manipul':113C 'model':76B 'os':10A,59B,120C 'paramet':37B 'pass':33B 'ping':4A,35B,40B,110C,117C 'product':163C 'proof':66B 'public':65B,137C 'remot':7A,128C 'respond':86B,155C 'retriev':74B 'router':3A,26B,63B 'run':9A,58B 'sanitis':47B 'shell':45B 'support':168C 'system':44B,102C 'use':141C 'user':8A,52B 'vendor':83B,145C 'vuldb':72B 'vulner':160C 'way':158C 'weak':88C 'web':55B 'without':46B 'wrt54gl':2A,18A,29B,31B,94C","nicknames":[],"mitigations":[],"who_affected":"Anyone still running a Linksys WRT54GL on firmware 4.30.18. The attacker needs a logged-in admin session (high privileges), so routers with default or weak admin passwords, or with the web admin reachable from the internet or untrusted LAN, are the real risk. Other models and routers whose admin is not reachable and has a strong password can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wrt54gl"],"ptokens":["wrt54gl"],"labels":["authenticated","critical","endoflife","homerouter","infrastructure","linksys","wrt54gl"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121930","severity":null,"published_at":"2026-11-04T19:17:32+00:00","modified_at":"2026-11-04T19:17:33+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121930:1694","url":null,"severity":null,"published_at":"2026-11-04T19:31:24+00:00","modified_at":"2026-11-04T19:31:24+00:00","first_seen_at":"2026-11-04T19:31:24+00:00","fetched_at":"2026-11-04T19:31:24+00:00","note":"NVD page returned empty; read VulDB VDB-431042 (CNA). Vector is CVSS4 PR:H, so authenticated, not pre-auth. PoC public on GitHub (link locked on VulDB), no exploitation reported. No vendor page; nothing marked verified. Sibling CVE-2026-121931 (traceroute) likely same pattern; X not checked."}],"documents":[{"id":69885,"url":"https://vuldb.com/vuln/431042","title":"VulDB VDB-431042: Linksys WRT54GL 4.30.18 ping_ip OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":69886,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121930","title":"NVD CVE-2026-121930","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}