CVE-2026-121932: OS command injection in Linksys E5350

CVE-2026-121932 identifies an unauthenticated OS command injection in Linksys E5350 version 1.0.00.037. The vulnerability resides in the system function of /wizard/apply.cgi and can be exploited by manipulating ping_ip and traceroute_ip parameters. A remote attacker can execute arbitrary system commands without any authentication, completely compromising the device.

The vulnerability is rated CVSS 10.0 (critical) and reflects maximum risk level: unauthenticated remote execution with complete impact on confidentiality, integrity, and availability. According to NVD data, the exploit is already public and usable. Linksys was contacted in advance but did not respond. No official patch has been released to date. Public channel activity (3 posts in the last 24 hours) confirms security community interest.

For IT teams and CISOs managing Linksys E5350 infrastructure: immediately verify whether the model is present in your network, especially in Internet-exposed environments. Implement firewall rules to block or restrict access to /wizard/apply.cgi from untrusted networks. Monitor system and network logs for exploitation attempts. Contact Linksys support for information on updated firmware availability. While awaiting patches, consider withdrawing the device or isolating it from critical networks.

Linksys E5350 is a commercial WiFi router commonly used in small-to-medium business environments and advanced home networks. The vulnerability in the web configuration wizard is particularly critical as it exposes an administration interface to high risk. The vendor's lack of response is a concerning signal and underscores the importance of continuous assessment of network device lifecycle.