---
id: "CVE-2026-121930"
kind: "vulnerability"
aliases: ["CVE-2026-121930"]
title: "Linksys WRT54GL router: ping diagnostic lets remote users run OS commands"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WRT54GL", "fixed": [], "affected": "4.30.18", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "end-of-life", "home-router", "infrastructure", "linksys", "wrt54gl"]
not_affected_if: ["other-models", "remote-management-disabled", "web-admin-not-exposed"]
published_at: "2026-11-04T19:17:32+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:31:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121930", "first_seen_at": "2026-11-04T19:28:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T19:31:24+00:00"}]
---

# Linksys WRT54GL router: ping diagnostic lets remote users run OS commands

Linksys WRT54GL 4.30.18 passes the ping_ip parameter of apply.cgi (Ping Diagnostic) to a system shell without sanitising it, so an authenticated user of the web admin can run OS commands on the router. A public proof of concept exists (linked from VulDB; not retrieved). The model is end of life and the vendor did not respond.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WRT54GL affected 4.30.18 fixed ?

## How to check

- Admin page > Status: firmware version 4.30.18 on a WRT54GL is the affected combination.
- Exploitation needs a logged-in admin session (CVSS vector PR:H; VulDB: further authentication required), so check that the admin password is not the default (admin/admin or admin/password are common on this model) and that remote management / port-forwarding to the router's web admin is off.
- Also check any other WRT54GL firmware you run; only 4.30.18 is named.

## Fix

No fix: end-of-life model, vendor did not respond to the disclosure (VulDB). Replace the router; until then disable remote management and change the default admin password.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121930
- 2026-11-04T19:31:24+00:00 analyst — NVD page returned empty; read VulDB VDB-431042 (CNA). Vector is CVSS4 PR:H, so authenticated, not pre-auth. PoC public on GitHub (link locked on VulDB), no exploitation reported. No vendor page; nothing marked verified. Sibling CVE-2026-121931 (traceroute) likely same pattern; X not checked.

## Documents

- [advisory] VulDB VDB-431042: Linksys WRT54GL 4.30.18 ping_ip OS command injection https://vuldb.com/vuln/431042
- [describes] NVD CVE-2026-121930 https://nvd.nist.gov/vuln/detail/CVE-2026-121930

## From the sources

A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_