PT-2026-137098
CVE-2026-121932
·
Published
2026-11-04
·
Updated
2026-11-05
Description by
CVSS 3.1
10
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linksys E5350 version 1.0.00.037
Description
An OS command injection flaw exists in the
/wizard/apply.cgi endpoint. This issue occurs within the system() function when the ping ip or traceroute ip variables are manipulated, allowing a remote attacker who can access the admin page to execute arbitrary commands on the device.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾