E5350 · CVE-2026-121932 · Infrastructure
NO FIX YET
VulDB (the CNA) reports that Linksys E5350 firmware 1.0.00.037 passes ping_ip/traceroute_ip in /wizard/apply.cgi to a system call, allowing OS command injection. VulDB says no authentication is required and a public proof of concept exists; no exploitation in the wild is reported. Linksys did not respond to disclosure and no fix or mitigation is known.
first public Nov 4, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Owners of Linksys E5350 routers running firmware 1.0.00.037 are exposed, particularly if the web interface can be reached from outside the home or office network. The sources say the vendor did not respond to early disclosure, so no patch is confirmed. Devices not running this model or firmware are not affected.
Not affected if admin-not-exposed, different-firmware, different-model
Who cares e5350, firmware, home-router, linksys, unauthenticated
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121932") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.