CVE-2026-121931

Summary

The Linksys WRT54GL router's traceroute diagnostic function allows OS command injection via unsanitized input to the traceroute_ip parameter in apply.cgi, enabling authenticated remote attackers to execute arbitrary commands on the device.

Exploitability

Exploitation requires valid administrator credentials due to PR:H in the CVSS vector, and the vulnerable endpoint is publicly exposed over the network (AV:N).

Blast radius

Successful exploitation grants full control of the router, enabling data exfiltration, service disruption, or use as a pivot point for lateral movement within the internal network.

Detection

Look for HTTP POST requests to /apply.cgi containing traceroute_ip parameters with shell metacharacters (e.g., ;, |, $(), backticks) in web server logs or firewall/proxy logs. Also monitor for unexpected outbound connections from the router to external IPs, especially to known C2 infrastructure.

Prioritized remediation

Discontinue use of this unsupported device immediately; migrate to a vendor-supported router with patched firmware. No fixed version is available as the product is end-of-life and the vendor did not respond to disclosure.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.