CVE-2026-108896 is a critical OS command injection flaw in Linksys E1700 firmware 1.0.0.4.003. A public exploit exists, and the vendor did not respond to the disclosure.
What Is It
The flaw is in the setLinksysIpv6 function, which is reached through the /goform/setLinksysIpv6 endpoint. An attacker can manipulate the _6rd_prefix and _6rd_prefix_len arguments to inject operating system commands on the device. VulDB (the CNA) classifies it as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
Why It Matters
- Severity: CVSS v3.1 base score of 9.9 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The CVSS v4.0 score is 8.6 (HIGH), and the CVSS v2 score is 9.0. - Remote and low complexity: The attack works over the network, needs no user interaction, and requires only low privileges. The scope is "changed," with high impact to confidentiality, integrity and availability.
- Public exploit: According to the CVE description, the exploit has been made public and could be used. The CVSS v4.0 exploit maturity is rated Proof-of-Concept.
- Exploitation status: No CISA KEV entry was provided for this CVE, so CISA has not confirmed active in-the-wild exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| Linksys | E1700 | Firmware 1.0.0.4.003 |
Affected CPE: cpe:2.3:o:linksys:e1700_firmware:*:*:*:*:*:*:*:*
Patch Status
The source material lists no patch or fixed firmware version. The CVE description says the vendor was contacted early about the disclosure but did not respond in any way. There is no CISA KEV entry, so no federal required action or due date has been issued.
E1700 owners should watch the Linksys site and the references below for vendor updates. Until a fix is available, treat devices running firmware 1.0.0.4.003 as exposed to a publicly documented exploit.