---
id: "CVE-2026-121932"
kind: "vulnerability"
aliases: ["CVE-2026-121932"]
title: "Linksys E5350 router: remote OS command injection via wizard apply.cgi"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "E5350", "fixed": [], "affected": "1.0.00.037", "ecosystem": "linksys"}]
ecosystems: []
tags: ["e5350", "firmware", "home-router", "infrastructure", "linksys", "poc-public", "unauthenticated"]
not_affected_if: ["admin-not-exposed", "different-firmware", "different-model"]
published_at: "2026-11-04T19:17:33+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:31:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121932", "first_seen_at": "2026-11-04T19:28:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T19:31:21+00:00"}]
---

# Linksys E5350 router: remote OS command injection via wizard apply.cgi

VulDB (the CNA) reports that Linksys E5350 firmware 1.0.00.037 passes ping_ip/traceroute_ip in /wizard/apply.cgi to a system call, allowing OS command injection. VulDB says no authentication is required and a public proof of concept exists; no exploitation in the wild is reported. Linksys did not respond to disclosure and no fix or mitigation is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linksys:E5350 affected 1.0.00.037 fixed ?

## How to check

- Open the router admin page and read the firmware version under the status/firmware page; 1.0.00.037 is the reported affected version.
- Check that remote administration is off and the admin page is not reachable from the internet or untrusted networks.
- Other E5350 firmware versions are not named by the source; also check if you run a different version, since only 1.0.00.037 was tested.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121932
- 2026-11-04T19:31:21+00:00 analyst — Only third-party source found: VulDB VDB-431044 (CNA). No Linksys advisory found, no fix; vendor silent. VulDB says unauthenticated, PoC public on github (link not shown, paywalled). Nothing verified: no vendor page. Exploited in wild not reported.

## Documents

- [describes] VulDB VDB-431044: Linksys E5350 apply.cgi OS command injection https://vuldb.com/vuln/431044

## From the sources

A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_