Linksys E5350 router setup page command injection flaw

Summary

The setup wizard page (/wizard/apply.cgi) on the Linksys E5350 router lets a remote attacker run OS commands by manipulating the ping_ip and traceroute_ip values. Public exploit code exists, and the vendor did not respond to the disclosure.

What to do

No fixed version is confirmed, and the vendor did not respond. Keep the admin page off the internet and check the vendor's notices.

Update these devices now!

• Linksys E5350

Products and platforms

• Linksys E5350

CVE IDs

• CVE-2026-121932 (opens in a new tab)

Sources

• Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 19:00 UTC

First seen 2026-11-09 16:00 UTC