{"id":"CVE-2026-121932","kind":"vulnerability","aliases":["CVE-2026-121932"],"related":[],"title":"Linksys E5350 router: remote OS command injection via wizard apply.cgi","description":"A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"VulDB (the CNA) reports that Linksys E5350 firmware 1.0.00.037 passes ping_ip/traceroute_ip in /wizard/apply.cgi to a system call, allowing OS command injection. VulDB says no authentication is required and a public proof of concept exists; no exploitation in the wild is reported. Linksys did not respond to disclosure and no fix or mitigation is known.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"E5350","fixed":[],"affected":"1.0.00.037","ecosystem":"linksys"}],"ecosystems":[],"tags":["e5350","firmware","home-router","infrastructure","linksys","poc-public","unauthenticated"],"not_affected_if":["admin-not-exposed","different-firmware","different-model"],"how_to_check":"- Open the router admin page and read the firmware version under the status/firmware page; 1.0.00.037 is the reported affected version.\n- Check that remote administration is off and the admin page is not reachable from the internet or untrusted networks.\n- Other E5350 firmware versions are not named by the source; also check if you run a different version, since only 1.0.00.037 was tested.","fix":null,"status":"open","published_at":"2026-11-04T19:17:33+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","triaged_at":"2026-11-04T19:30:02+00:00","updated_at":"2026-11-04T19:31:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T19:30:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys E5350 router: remote OS command injection via wizard apply.cgi","impact":"high","summary":"The Linksys E5350 router firmware 1.0.00.037 passes the ping_ip and traceroute_ip arguments of /wizard/apply.cgi to a system shell without sanitizing them. A remote attacker can inject operating system commands and run them on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","e5350","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router remotely","analyst_note":"Confirm whether a fixed firmware exists and whether authentication is required for /wizard/apply.cgi; check NVD and the vendor advisory for affected versions.","how_to_check":"- Check the firmware version in the router admin interface; the affected version is `1.0.00.037`\n- Confirm whether the router's web administration is reachable from the internet or untrusted networks\n- unknown whether the sources list other affected firmware versions","plain_action":"Check your Linksys E5350 router's firmware version and limit access to its admin page while no fix is confirmed.","needs_analyst":true,"not_affected_if":["different-model","different-firmware","admin-not-exposed"],"who_is_affected":"Owners of Linksys E5350 routers running firmware 1.0.00.037 are exposed, particularly if the web interface can be reached from outside the home or office network. The sources say the vendor did not respond to early disclosure, so no patch is confirmed. Devices not running this model or firmware are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":4140,"output_tokens":627,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a fixed firmware exists and whether authentication is required for /wizard/apply.cgi; check NVD and the vendor advisory for affected versions.","search":"'-121932':13A,16A '-2026':12A,15A '/wizard/apply.cgi':42B,100C '1.0.00.037':37B,91C 'affect':93C 'allow':47B 'apply.cgi':10A 'argument':106C 'attack':115C 'authent':54B 'call':46B 'cna':31B 'command':6A,49B,112C 'concept':62B 'contact':132C 'cve':11A,14A 'detect':87C 'disclosur':76B,136C 'e5350':2A,17A,18B,35B,90C 'earli':133C 'exist':63B 'exploit':65B,121C 'file':99C 'firmwar':19B,36B 'fix':79B 'function':95C 'home':21B 'home-rout':20B 'infrastructur':23B 'initi':118C 'inject':7A,50B,113C 'ip/traceroute_ip':40B,108C 'known':83B 'linksi':1A,24B,34B,71B,89C 'manipul':103C 'may':116C,126C 'mitig':81B 'os':5A,48B,111C 'pass':38B 'perform':101C 'ping':39B,107C 'poc':26B 'poc-publ':25B 'proof':60B 'public':27B,59B,124C 'remot':4A,119C 'report':32B,70B 'requir':56B 'respond':74B,140C 'result':109C 'router':3A,22B 'say':52B 'system':45B,96C 'unauthent':28B 'use':128C 'vendor':130C 'via':8A 'vuldb':29B,51B 'vulner':85C 'way':143C 'wild':68B 'wizard':9A","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys E5350 routers running firmware 1.0.00.037 are exposed, particularly if the web interface can be reached from outside the home or office network. The sources say the vendor did not respond to early disclosure, so no patch is confirmed. Devices not running this model or firmware are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check your Linksys E5350 router's firmware version and limit access to its admin page while no fix is confirmed.","pkeys":["e5350"],"ptokens":["e5350"],"labels":["critical","e5350","firmware","homerouter","infrastructure","linksys","pocpublic","unauthenticated"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121932","severity":null,"published_at":"2026-11-04T19:17:33+00:00","modified_at":"2026-11-04T19:17:33+00:00","first_seen_at":"2026-11-04T19:28:48+00:00","fetched_at":"2026-11-04T19:28:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121932:1692","url":null,"severity":null,"published_at":"2026-11-04T19:31:21+00:00","modified_at":"2026-11-04T19:31:21+00:00","first_seen_at":"2026-11-04T19:31:21+00:00","fetched_at":"2026-11-04T19:31:21+00:00","note":"Only third-party source found: VulDB VDB-431044 (CNA). No Linksys advisory found, no fix; vendor silent. VulDB says unauthenticated, PoC public on github (link not shown, paywalled). Nothing verified: no vendor page. Exploited in wild not reported."}],"documents":[{"id":69884,"url":"https://vuldb.com/vuln/431044","title":"VulDB VDB-431044: Linksys E5350 apply.cgi OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}