CVE-2026-121933 is a remotely exploitable, critical missing-authentication flaw in the Setup Wizard of the Linksys E5350 router, firmware 1.0.00.037; a public exploit exists and the vendor has not responded.
What Is It
The flaw is in the save_settings function of /wizard/apply.cgi, part of the E5350's Setup Wizard component. According to the record, manipulating the wizard_router_pwd argument can lead to missing authentication. The weaknesses are classified as CWE-287 and CWE-306.
VulDB, the CNA, published the CVE on 2026-11-04. Its NVD status is "Deferred," so NVD has not done its own analysis and the scores below come from the CNA.
Why It Matters
- Remote, no authentication, no user interaction: The CVSS 3.1 vector is
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives a base score of 10.0 (CRITICAL). The scope is "changed," and confidentiality, integrity and availability impacts are all high. - CVSS 4.0: The score is 9.3 (CRITICAL), with high impact on both the vulnerable system and subsequent systems.
- Public exploit: The record says "the exploit has been published and may be used." The CVSS 4.0 exploit maturity is Proof-of-Concept.
- No vendor response: The record says Linksys "was contacted early about this disclosure but did not respond in any way."
KEV status: The supplied CISA KEV entry is empty. CISA's Known Exploited Vulnerabilities catalog does not currently confirm active exploitation, and KEV sets no required action or due date. A public exploit for an unauthenticated network flaw on an edge device still makes this a high priority.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | Linksys |
| Product | E5350 |
| Component | Setup Wizard (/wizard/apply.cgi, save_settings) |
| Affected version | 1.0.00.037 |
| CPE | cpe:2.3:h:linksys:e5350:*:*:*:*:*:*:*:* |
The source data lists no other affected versions.
Patch Status
The supplied data contains no patch, fixed firmware version or vendor advisory. Linksys did not respond to the disclosure, so you should not assume a fix exists. The record gives no official remediation guidance. Owners of E5350 units on 1.0.00.037 should check the Linksys site directly for firmware updates and watch the references below for changes.