CVE-2026-121930 is a critical OS command injection flaw in the Ping Diagnostic of the end-of-life Linksys WRT54GL router; a public exploit exists and no vendor fix is available.
What Is It
CVE-2026-121930 affects Linksys WRT54GL firmware version 4.30.18. The flaw is in the system function of apply.cgi, inside the Ping Diagnostic component. An attacker who changes the ping_ip argument can inject operating system commands. The CNA (VulDB) classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The attack can be launched remotely. The CVSS vectors say the attacker needs high privileges, which means authenticated access to the device.
Why It Matters
VulDB rates this CVSS 3.1 9.1 (Critical) with the vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The changed scope and high confidentiality, integrity and availability impacts mean a successful attack could affect systems beyond the router itself. The CVSS 4.0 score is 8.5 (High) and the CVSS 2.0 score is 8.3 (High).
According to the CVE description, the exploit is public and could be used in attacks. CVSS 4.0 rates the exploit maturity as Proof-of-Concept. The CISA KEV entry supplied for this brief is empty, so KEV does not confirm active exploitation.
What's Vulnerable
- Vendor: Linksys
- Product: WRT54GL (
cpe:2.3:h:linksys:wrt54gl:*:*:*:*:*:*:*:*) - Affected version: 4.30.18
- Component: Ping Diagnostic (
apply.cgi,ping_ipparameter)
The CVE is tagged unsupported-when-assigned. According to the description, the flaw affects only products that the maintainer no longer supports.
Patch Status
No patch is available. The disclosure says Linksys was contacted early but did not respond. The product is no longer supported, so a fix is unlikely. CISA has not set a required action or due date because there is no KEV entry.
On NVD, the record has the status "Deferred." It was published 2026-11-04.
Owners who still run WRT54GL devices should treat them as permanently vulnerable. They should plan to replace them with supported hardware. Until then, they should limit who can reach and log in to the management interface.