CVE-2026-108896

Summary

A command injection vulnerability exists in Linksys E1700 routers that allows remote attackers to execute arbitrary OS commands with elevated privileges. This flaw is particularly dangerous because it can be exploited without authentication and affects critical network configuration functions.

Exploitability

The exploit is highly practical with no authentication required, leveraging a publicly available exploit that directly targets the vulnerable setLinksysIpv6 function through the /goform/setLinksysIpv6 endpoint.

Blast radius

The vulnerability could impact thousands of Linksys E1700 routers globally, potentially allowing attackers to gain full remote control of affected devices and use them as launching points for further network attacks.

Detection

Monitor for unusual POST requests to /goform/setLinksysIpv6 endpoint with suspicious command injection payloads in _6rd_prefix or _6rd_prefix_len parameters, and watch for unexpected process execution patterns on affected routers.

Prioritized remediation

Upgrade to firmware version 1.0.0.4.004 or later immediately, as this specific version contains the patched implementation of the setLinksysIpv6 function that resolves the command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.