Linksys WRT54GL ping diagnostic allows OS command injection

Old Linksys routers can be hacked remotely!

Summary

The Ping Diagnostic function (apply.cgi) of the Linksys WRT54GL router can be manipulated to run operating system commands remotely. Only products no longer supported by the maintainer are affected, and public exploit code exists.

What to do

The product is no longer supported by the maintainer, so no fixed version exists.

Update these devices now!

Linksys WRT54GL

Products and platforms

Linksys WRT54GL

CVE IDs

CVE-2026-121930 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 18:30 UTC

First seen 2026-11-09 16:00 UTC