---
id: "CVE-2026-121931"
kind: "vulnerability"
aliases: ["CVE-2026-121931"]
title: "Linksys WRT54GL router: traceroute field lets remote attackers run OS commands"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WRT54GL", "fixed": [], "affected": "4.30.18", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "end-of-life", "firmware", "home-network", "infrastructure", "linksys", "router", "wrt54gl"]
not_affected_if: ["admin-not-exposed", "auth-required", "other-model", "unsupported-model-replaced"]
published_at: "2026-11-04T19:17:33+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:31:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121931", "first_seen_at": "2026-11-04T19:28:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T19:31:26+00:00"}]
---

# Linksys WRT54GL router: traceroute field lets remote attackers run OS commands

Linksys WRT54GL 4.30.18 passes traceroute_ip from the Traceroute Diagnostic page (apply.cgi) into a system command unsanitised, so an attacker can inject OS commands. VulDB says additional authentication is required (CVSS PR:H, i.e. admin login). A proof of concept is public; no exploitation in the wild is reported. The vendor did not respond and the model is end of life; VulDB lists no fix or mitigation and suggests replacing the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WRT54GL affected 4.30.18 fixed ?

## How to check

- Open the router's status page and check whether the model is WRT54GL and the firmware reads 4.30.18.
- Check whether the web admin interface (apply.cgi) is reachable from the internet (remote management enabled) or from untrusted LAN/Wi-Fi clients; if so, turn remote management off.
- Change default admin credentials: exploitation needs a logged-in admin session, so default or weak passwords make this reachable.
- Also check other WRT54GL firmware builds; the sources only name 4.30.18.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121931
- 2026-11-04T19:31:26+00:00 analyst — VulDB VDB-431043 (linked) says auth required (CVSS PR:H), PoC public (GitHub, link not visible), vendor silent, EOL, no mitigation known; replacement suggested. NVD page returned empty from web-cli. Not verified: no vendor page. X not checked. Sibling CVE-2026-121930 (ping_ip) same product.

## Documents

- [advisory] VulDB VDB-431043: Linksys WRT54GL 4.30.18 traceroute_ip OS command injection https://vuldb.com/vuln/431043
- [describes] NVD CVE-2026-121931 https://nvd.nist.gov/vuln/detail/CVE-2026-121931

## From the sources

A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_