CVE-2026-121932

Summary

The Linksys E5350 router's /wizard/apply.cgi endpoint allows unauthenticated remote attackers to inject and execute arbitrary OS commands via the ping_ip or traceroute_ip parameters due to insufficient input sanitization in the 'system' function, leading to full device compromise.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible over HTTP.

Blast radius

Successful exploitation grants full root-level control of the router, enabling persistent network surveillance, man-in-the-middle attacks, lateral movement, and potential disruption of all connected devices.

Detection

Look for HTTP POST requests to /wizard/apply.cgi containing suspicious shell metacharacters (e.g., ';', '|', '$(', backticks) or known command sequences (e.g., 'ping -c 1 127.0.0.1; whoami') in the ping_ip or traceroute_ip parameters in web access logs.

Prioritized remediation

Upgrade to firmware version 1.0.00.038 or later if available; if no patched version is published by the vendor (as indicated by lack of response), disable the wizard/apply.cgi endpoint and restrict access to management interfaces via network segmentation or firewall rules.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.