CVE-2026-108894

Summary

A command injection vulnerability exists in Linksys E1700 routers that allows remote attackers to execute arbitrary OS commands with administrative privileges. This flaw affects the Static Route Handler component and can be exploited by manipulating route settings parameters.

Exploitability

The vulnerability is highly exploitable with no authentication required, allowing remote attackers to inject OS commands through the static route configuration interface with minimal setup.

Blast radius

The flaw impacts all Linksys E1700 routers running firmware version 1.0.0.4.003, potentially enabling attackers to gain full administrative control over affected devices and use them as entry points for network-wide attacks.

Detection

Monitor for unusual POST requests to /goform/addStaticRoute endpoint with suspicious command injection patterns in parameters like staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting, particularly when these requests originate from unauthenticated sources.

Prioritized remediation

Upgrade to firmware version 1.0.0.4.004 or later immediately, as this is the first patch that addresses the command injection vulnerability in the Static Route Handler component.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.