{"id":"CVE-2026-121931","kind":"vulnerability","aliases":["CVE-2026-121931"],"related":[],"title":"Linksys WRT54GL router: traceroute field lets remote attackers run OS commands","description":"A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Linksys WRT54GL 4.30.18 passes traceroute_ip from the Traceroute Diagnostic page (apply.cgi) into a system command unsanitised, so an attacker can inject OS commands. VulDB says additional authentication is required (CVSS PR:H, i.e. admin login). A proof of concept is public; no exploitation in the wild is reported. The vendor did not respond and the model is end of life; VulDB lists no fix or mitigation and suggests replacing the device.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WRT54GL","fixed":[],"affected":"4.30.18","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","end-of-life","firmware","home-network","infrastructure","linksys","router","wrt54gl"],"not_affected_if":["admin-not-exposed","auth-required","other-model","unsupported-model-replaced"],"how_to_check":"- Open the router's status page and check whether the model is WRT54GL and the firmware reads 4.30.18.\n- Check whether the web admin interface (apply.cgi) is reachable from the internet (remote management enabled) or from untrusted LAN/Wi-Fi clients; if so, turn remote management off.\n- Change default admin credentials: exploitation needs a logged-in admin session, so default or weak passwords make this reachable.\n- Also check other WRT54GL firmware builds; the sources only name 4.30.18.","fix":null,"status":"open","published_at":"2026-11-04T19:17:33+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:02+00:00","updated_at":"2026-11-04T19:31:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T19:30:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys WRT54GL router: traceroute field lets remote attackers run OS commands","impact":"high","summary":"The Linksys WRT54GL 4.30.18 router firmware passes the traceroute_ip argument from its Traceroute Diagnostic page (apply.cgi) into a system command without checking it. A remote attacker can inject operating system commands through that field, and the exploit has been published.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linksys","wrt54gl","router","firmware","home-network"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router remotely","analyst_note":"Confirm whether the traceroute page needs admin login and whether the NVD entry or a vendor notice gives any replacement guidance for this unsupported model.","how_to_check":"- Look up the firmware version on the router's status page and check whether it reads `4.30.18`\n- Confirm whether the router's web admin interface is reachable from the internet\n- Check whether the model is a WRT54GL, which the sources say is no longer supported by the vendor","plain_action":"","needs_analyst":true,"not_affected_if":["unsupported-model-replaced","admin-not-exposed"],"who_is_affected":"Owners of Linksys WRT54GL routers running firmware 4.30.18 are exposed through the web-based traceroute diagnostic page in apply.cgi. The sources say the vendor did not respond to early disclosure and the product is no longer supported, so no patch is expected. Anyone running a different router model or a router whose admin interface is not reachable from outside the network can skip it, though the sources do not state exactly which configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000745,"input_tokens":4182,"output_tokens":653,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the traceroute page needs admin login and whether the NVD entry or a vendor notice gives any replacement guidance for this unsupported model.","search":"'-121931':14A,17A '-2026':13A,16A '4.30.18':36B,115C 'addit':60B 'admin':68B 'affect':179C 'apply.cgi':45B,126C 'argument':137C 'attack':8A,53B,146C 'auth':20B 'auth-requir':19B 'authent':61B 'command':11A,49B,57B,143C 'compon':129C 'concept':73B 'contact':164C 'cve':12A,15A 'cvss':64B 'detect':111C 'devic':105B 'diagnost':43B,131C 'disclos':155C 'disclosur':168C 'earli':165C 'element':118C 'end':23B,92B 'end-of-lif':22B 'exploit':77B,152C 'field':5A 'file':125C 'firmwar':26B 'fix':98B 'function':121C,132C 'h':66B 'home':28B 'home-network':27B 'i.e':67B 'impact':117C 'infrastructur':30B 'inject':55B,144C 'ip':39B,139C 'launch':149C 'lead':140C 'let':6A 'life':25B,94B 'linksi':1A,31B,34B,113C 'list':96B 'login':69B 'longer':184C 'maintain':188C 'manipul':134C 'may':158C 'mitig':100B 'model':90B 'network':29B 'os':10A,56B,142C 'page':44B 'pass':37B 'pr':65B 'product':180C 'proof':71B 'public':75B,156C 'remot':7A,150C 'replac':103B 'report':82B 'requir':21B,63B 'respond':87B,172C 'router':3A,32B 'run':9A 'say':59B 'secur':107C 'suggest':102B 'support':185C 'system':48B,122C 'tracerout':4A,38B,42B,130C,138C 'unsanitis':50B 'use':160C 'vendor':84B,162C 'vuldb':58B,95B 'vulner':108C,177C 'way':175C 'wild':80B 'wrt54gl':2A,18A,33B,35B,114C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys WRT54GL routers on firmware 4.30.18 are affected, but VulDB says an authenticated (admin) session is needed, so the risk is highest where the admin page is reachable from the internet or default/weak admin passwords are in use. The model is end of life and the vendor did not respond, so no patch is expected; replacing the router is the only suggested remedy. Other router models, or WRT54GL units whose admin interface is not exposed and has a strong password, can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Replace your Linksys WRT54GL router with a currently supported model, since Linksys has not issued a fix, and until then make sure its remote administration is turned off and its admin password is changed from the default.","pkeys":["wrt54gl"],"ptokens":["wrt54gl"],"labels":["authrequired","critical","endoflife","firmware","homenetwork","infrastructure","linksys","router","wrt54gl"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121931","severity":null,"published_at":"2026-11-04T19:17:33+00:00","modified_at":"2026-11-04T19:17:33+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121931:1693","url":null,"severity":null,"published_at":"2026-11-04T19:31:26+00:00","modified_at":"2026-11-04T19:31:26+00:00","first_seen_at":"2026-11-04T19:31:26+00:00","fetched_at":"2026-11-04T19:31:26+00:00","note":"VulDB VDB-431043 (linked) says auth required (CVSS PR:H), PoC public (GitHub, link not visible), vendor silent, EOL, no mitigation known; replacement suggested. NVD page returned empty from web-cli. Not verified: no vendor page. X not checked. Sibling CVE-2026-121930 (ping_ip) same product."}],"documents":[{"id":69882,"url":"https://vuldb.com/vuln/431043","title":"VulDB VDB-431043: Linksys WRT54GL 4.30.18 traceroute_ip OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":69883,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121931","title":"NVD CVE-2026-121931","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}