CVE-2026-121932 is a critical OS command injection flaw in Linksys E5350 firmware 1.0.00.037. It can be triggered remotely, a public exploit exists, and the vendor did not respond to the disclosure.
What Is It
CVE-2026-121932 is in the /wizard/apply.cgi file of the Linksys E5350, in a function that calls system. An attacker who changes the ping_ip or traceroute_ip argument can inject operating system commands. The weakness is classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The researcher's published write-up labels the issue a "wizard preauth command injection." The CVSS vector agrees: an attacker needs no privileges and no user interaction.
Why It Matters
VulDB, the CVE Numbering Authority (CNA) for this CVE, rates it at the top of the scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated as Proof-of-Concept
- CVSS 2.0: 10.0
The attack works over the network, is low complexity and needs no authentication. If it succeeds, the attacker gains high impact to confidentiality, integrity and availability. The scope is "changed," meaning the impact extends beyond the vulnerable component.
The description says the exploit "is now public and may be used." It also says the vendor was contacted early about the disclosure "but did not respond in any way."
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm any active exploitation in the wild.
What's Vulnerable
- Vendor: Linksys
- Product: E5350
- Affected version: 1.0.00.037
- CPE:
cpe:2.3:h:linksys:e5350:*:*:*:*:*:*:*:*
Patch Status
The source material lists no vendor patch or advisory. According to the disclosure, Linksys did not respond to the researcher's contact. There is no CISA KEV entry, so no federal remediation action or due date has been set.
Until Linksys provides fixed firmware, owners of E5350 devices running 1.0.00.037 should treat the device as exposed. Check the Linksys site and the VulDB entry for updates.