CVE-2026-121932

EUVD-2026-117050
A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/Zimo-666/E5350-cves/tree/main/01-wizard-preauth-command-injection
https://vuldb.com/cve/CVE-2026-121932
https://vuldb.com/submit/1024275
https://vuldb.com/submit/1024277
https://vuldb.com/vuln/431044
https://vuldb.com/vuln/431044/cti
https://www.linksys.com/