CVE-2026-121930

Summary

The Linksys WRT54GL router's ping diagnostic feature allows remote OS command injection via the ping_ip parameter in apply.cgi due to insufficient input sanitization, enabling authenticated attackers to execute arbitrary commands on the device.

Exploitability

Exploitation requires valid admin credentials and network access to the web interface; the public exploit makes it trivial for attackers with those credentials.

Blast radius

Successful exploitation grants full control of the router, allowing attackers to intercept traffic, pivot into internal networks, or disrupt connectivity.

Detection

Look for HTTP POST requests to /apply.cgi containing suspicious shell metacharacters (e.g., ';', '|', '&') in the ping_ip parameter, especially from non-admin IP addresses or at unusual times. Also monitor for unexpected processes like 'ping' spawning additional commands in system logs.

Prioritized remediation

Upgrade to firmware version 4.30.19 or later if available; otherwise, disable the Ping Diagnostic feature and restrict access to apply.cgi to trusted management networks only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.