---
id: "CVE-2026-121933"
kind: "vulnerability"
aliases: ["CVE-2026-121933"]
title: "Linksys E5350 router: setup wizard lets remote users skip authentication"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Linksys E5350", "fixed": [], "affected": "1.0.00.037", "ecosystem": "vendor"}]
ecosystems: []
tags: ["e5350", "firmware", "home-router", "infrastructure", "linksys"]
not_affected_if: ["no-remote-admin-access", "other-firmware-version"]
published_at: "2026-11-04T20:19:11+00:00"
first_seen_at: "2026-11-04T20:29:03+00:00"
updated_at: "2026-11-04T20:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121933", "first_seen_at": "2026-11-04T20:29:03+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T20:30:57+00:00"}]
---

# Linksys E5350 router: setup wizard lets remote users skip authentication

The setup wizard on the Linksys E5350 router (firmware 1.0.00.037) does not check authentication when its save_settings function handles the wizard_router_pwd argument. A remote attacker can change router settings without logging in, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Linksys E5350 affected 1.0.00.037 fixed ?

## How to check

Log in to the router admin page and read the firmware version under status; 1.0.00.037 is the affected version (and the latest Linksys lists). Also check whether remote management / WAN-side admin access is enabled; if it is, turn it off. Other firmware versions: unknown, no source says.

## Fix

No fix known. Linksys's E5350 download page still lists 1.0.00.037 (dated 5/17/2022) as the latest firmware, and VulDB says the vendor did not respond to disclosure.

## Timeline

- 2026-11-04T20:29:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121933
- 2026-11-04T20:30:57+00:00 analyst — VulDB (third party) is the only description of the flaw; the vendor has no advisory. Linksys support page shows the affected 1.0.00.037 is still the latest firmware, so no fix. PoC link not found, so PoC is unconfirmed beyond the 'exploit published' claim. Nothing verified: no vendor statement.

## Documents

- [describes] VulDB: Linksys E5350 wizard_router_pwd missing authentication https://vuldb.com/vuln/431045
- [fix] Linksys E5350 downloads (latest firmware 1.0.00.037, 5/17/2022) https://support.linksys.com/kb/article/550/

## From the sources

A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_