WRT54GL · CVE-2026-121931 · Infrastructure
NO FIX YET
Linksys WRT54GL 4.30.18 passes traceroute_ip from the Traceroute Diagnostic page (apply.cgi) into a system command unsanitised, so an attacker can inject OS commands. VulDB says additional authentication is required (CVSS PR:H, i.e. admin login). A proof of concept is public; no exploitation in the wild is reported. The vendor did not respond and the model is end of life; VulDB lists no fix or mitigation and suggests replacing the device.
first public Nov 4, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Owners of Linksys WRT54GL routers on firmware 4.30.18 are affected, but VulDB says an authenticated (admin) session is needed, so the risk is highest where the admin page is reachable from the internet or default/weak admin passwords are in use. The model is end of life and the vendor did not respond, so no patch is expected; replacing the router is the only suggested remedy. Other router models, or WRT54GL units whose admin interface is not exposed and has a strong password, can deprioritise it.
Not affected if admin-not-exposed, auth-required, other-model, unsupported-model-replaced
Who cares auth-required, end-of-life, firmware, home-network, linksys, router, wrt54gl
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-121931") · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.