CVE-2026-108895

Summary

A command injection vulnerability exists in Linksys E1700 routers that allows remote attackers to execute arbitrary OS commands with administrative privileges. This flaw is particularly dangerous because it can be exploited without authentication and can lead to complete system compromise.

Exploitability

The exploit is highly practical with no authentication required, allowing attackers to execute arbitrary commands remotely with high privileges, though it requires knowledge of the specific endpoint and parameter manipulation.

Blast radius

If exploited, this vulnerability could allow attackers to gain full administrative control over thousands of Linksys E1700 routers, potentially enabling large-scale network infiltration and persistent access to affected networks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 1.0.0.4.004 or later, which contains the patched setDMZ function in /goform/setDMZ to prevent MAC_addr parameter injection.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.