Linksys WRT54GL traceroute function allows OS command injection

Old Linksys routers can be taken over remotely with planted commands!

Summary

A flaw in the traceroute diagnostic function of Linksys WRT54GL 4.30.18 lets a remote attacker inject OS commands. Public exploit code exists, the vendor did not respond, and the product is no longer supported.

What to do

The product is no longer supported and no fixed version exists; no update is available.

Update these devices now!

Linksys WRT54GL

Products and platforms

Linksys WRT54GL

CVE IDs

CVE-2026-121931 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 18:45 UTC

First seen 2026-11-09 16:00 UTC