CVE-2026-121933

Summary

The Linksys E5350 router’s Setup Wizard endpoint `/wizard/apply.cgi` lacks authentication for the `save_settings` function, allowing remote attackers to modify critical settings—including the admin password—by manipulating the `wizard_router_pwd` argument.

Exploitability

Trivial to exploit; no authentication or user interaction required, and a public exploit exists.

Blast radius

Complete device compromise is possible: an attacker can reset the admin password, reconfigure network settings, and potentially pivot to other internal devices.

Detection

Look for POST requests to `/wizard/apply.cgi` with `wizard_router_pwd` parameter in logs of the router’s web server or any upstream reverse proxy; repeated or anomalous password-change attempts without prior admin login are highly suspicious.

Prioritized remediation

Upgrade to firmware version 1.0.00.038 or later, as the vendor confirmed a fix was released after early disclosure but did not respond further; until then, disable the Setup Wizard endpoint by blocking access to `/wizard/apply.cgi` and restrict management access to trusted LAN IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.