CVE-2026-108894 is a critical (CVSS 3.1 9.9) OS command injection flaw in Linksys E1700 router firmware 1.0.0.4.003. A public exploit is available, and the vendor has not responded to the disclosure.
What Is It
CVE-2026-108894 is an OS command injection vulnerability (CWE-77, CWE-78) in the addStaticRoute function of /goform/addStaticRoute. That function is part of the Static Route Handler component in Linksys E1700 firmware. An attacker can inject OS commands through any of these arguments:
staticRoute_IP_settingstaticRoute_Netmask_settingstaticRoute_Gateway_settingstaticRoute_Metric_setting
VulDB is the CNA and published the CVE on 2026-10-12.
Why It Matters
- Remote exploitation: An attacker can carry out the attack over the network.
- Low bar to exploit: The CVSS 3.1 vector (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) means low attack complexity, low privileges, no user interaction and a changed scope. Impacts on confidentiality, integrity and availability are all high. - Public exploit: The CVE description says the exploit "has been released to the public and may be used for attacks." The CVSS 4.0 metric rates exploit maturity as Proof-of-Concept.
- No vendor response: The vendor was contacted early about this disclosure but did not respond.
Other scores from VulDB:
| Metric | Score | Severity |
|---|---|---|
| CVSS 4.0 | 8.6 | HIGH |
| CVSS 2.0 | 9.0 | HIGH |
KEV status: CVE-2026-108894 is not in the CISA Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation through KEV and has not issued a required action.
What's Vulnerable
- Vendor: Linksys
- Product: E1700
- Affected version: 1.0.0.4.003
- Component: Static Route Handler (
/goform/addStaticRoute) - CPE:
cpe:2.3:o:linksys:e1700_firmware:*:*:*:*:*:*:*:*
The source data lists only firmware 1.0.0.4.003 as affected.
Patch Status
The source material does not mention a patch, a fixed firmware version or a vendor advisory. The disclosure says Linksys did not respond. Because the CVE is not in KEV, CISA has published no remediation or required action. If you run E1700 devices on firmware 1.0.0.4.003, treat them as unpatched and exposed to a publicly available exploit.