{"id":"CVE-2026-121933","kind":"vulnerability","aliases":["CVE-2026-121933"],"related":[],"title":"Linksys E5350 router: setup wizard lets remote users skip authentication","description":"A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The setup wizard on the Linksys E5350 router (firmware 1.0.00.037) does not check authentication when its save_settings function handles the wizard_router_pwd argument. A remote attacker can change router settings without logging in, and a public exploit has been published.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Linksys E5350","fixed":[],"affected":"1.0.00.037","ecosystem":"vendor"}],"ecosystems":[],"tags":["e5350","firmware","home-router","infrastructure","linksys"],"not_affected_if":["no-remote-admin-access","other-firmware-version"],"how_to_check":"Log in to the router admin page and read the firmware version under status; 1.0.00.037 is the affected version (and the latest Linksys lists). Also check whether remote management / WAN-side admin access is enabled; if it is, turn it off. Other firmware versions: unknown, no source says.","fix":"No fix known. Linksys's E5350 download page still lists 1.0.00.037 (dated 5/17/2022) as the latest firmware, and VulDB says the vendor did not respond to disclosure.","status":"open","published_at":"2026-11-04T20:19:11+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","triaged_at":"2026-11-04T20:29:55+00:00","updated_at":"2026-11-04T20:30:57+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T20:29:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys E5350 router: setup wizard lets remote users skip authentication","impact":"high","summary":"The setup wizard on the Linksys E5350 router (firmware 1.0.00.037) does not check authentication when its save_settings function handles the wizard_router_pwd argument. A remote attacker can change router settings without logging in, and a public exploit has been published.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","e5350","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker changes router settings and takes control without logging in","analyst_note":"Confirm which firmware versions are affected and whether any vendor fix or mitigation exists; the sources say the vendor did not respond.","how_to_check":"- Log in to the router admin page and note the firmware version shown under status; it should read `1.0.00.037` if affected.\n- Check whether the router's admin interface is reachable from the internet (unknown from sources for other firmware versions).","plain_action":"If you own a Linksys E5350 router, check whether it is reachable from the internet and wait for Linksys to publish a fix; the sources say the vendor has not responded.","needs_analyst":true,"not_affected_if":["other-firmware-version","no-remote-admin-access"],"who_is_affected":"Owners of Linksys E5350 routers running firmware 1.0.00.037, where the setup wizard endpoint /wizard/apply.cgi is reachable. Exposure depends on whether the router's management interface can be reached from outside the home or office network. Sources do not say whether other firmware versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000726,"input_tokens":4148,"output_tokens":623,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which firmware versions are affected and whether any vendor fix or mitigation exists; the sources say the vendor did not respond.","search":"'-121933':13A,16A '-2026':12A,15A '/wizard/apply.cgi':86C '1.0.00.037':35B,76C 'argument':50B,97C 'attack':53B,107C 'authent':10A,39B,105C 'chang':55B 'check':38B 'compon':89C 'contact':124C 'cve':11A,14A 'disclosur':128C 'e5350':2A,18A,19B,32B,75C 'earli':125C 'execut':92C 'exploit':64B,113C 'file':85C 'firmwar':20B,34B 'flaw':69C 'found':72C 'function':44B,80C 'handl':45B 'home':22B 'home-rout':21B 'impact':78C 'infrastructur':24B 'launch':110C 'lead':102C 'let':6A 'linksi':1A,25B,31B,74C 'linksys':17A 'log':59B 'manipul':94C 'may':108C,118C 'miss':104C 'public':63B 'publish':67B,116C 'pwd':49B,100C 'remot':7A,52B,111C 'respond':132C 'router':3A,23B,33B,48B,56B,99C 'save':42B,81C 'set':43B,57B,82C 'setup':4A,27B,90C 'skip':9A 'use':120C 'user':8A 'vendor':122C 'way':135C 'without':58B 'wizard':5A,28B,47B,91C,98C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys E5350 routers running firmware 1.0.00.037, where the setup wizard endpoint /wizard/apply.cgi is reachable. Exposure depends on whether the router's management interface can be reached from outside the home or office network. Sources do not say whether other firmware versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Linksys E5350 router, check whether it is reachable from the internet and wait for Linksys to publish a fix; the sources say the vendor has not responded.","pkeys":["e5350","linksyse5350"],"ptokens":["e5350","linksys"],"labels":["critical","e5350","firmware","homerouter","infrastructure","linksys"],"campaign_type":null,"first_public_at":"2026-11-04T20:19:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121933","severity":null,"published_at":"2026-11-04T20:19:11+00:00","modified_at":"2026-11-04T20:19:11+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","fetched_at":"2026-11-04T20:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121933:1699","url":null,"severity":null,"published_at":"2026-11-04T20:30:57+00:00","modified_at":"2026-11-04T20:30:57+00:00","first_seen_at":"2026-11-04T20:30:57+00:00","fetched_at":"2026-11-04T20:30:57+00:00","note":"VulDB (third party) is the only description of the flaw; the vendor has no advisory. Linksys support page shows the affected 1.0.00.037 is still the latest firmware, so no fix. PoC link not found, so PoC is unconfirmed beyond the 'exploit published' claim. Nothing verified: no vendor statement."}],"documents":[{"id":70324,"url":"https://support.linksys.com/kb/article/550/","title":"Linksys E5350 downloads (latest firmware 1.0.00.037, 5/17/2022)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":70325,"url":"https://vuldb.com/vuln/431045","title":"VulDB: Linksys E5350 wizard_router_pwd missing authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}