Introduction
Every Linksys E5350 running firmware 1.0.00.037 goes through a setup window where its diagnostic interface can be reached without a password. During that window, an attacker on the local network can run shell commands as root. The condition applies to brand new units and to any router returned to factory state by a reset, so the exposure is less a rare misconfiguration than a predictable state every device passes through.
The E5350 is a consumer AC1000 WiFi 5 home router from Linksys, a networking brand that reports 250M+ devices shipped and a 25M+ active installed base. The affected firmware, 1.0.00.037, is the product's last release, and the original researcher describes the device as end of life. That matters because the documented remediation direction is replacement, not a patch.
Technical Information
The confirmed affected version is 1.0.00.037. The relevant components are the CyberTAN derived httpd web server together with the diag_pingbutton and diag_tracertbutton service binaries. The root cause is a missing authentication boundary (CWE-306) chained to OS command injection (CWE-77 and CWE-78), which yields unauthenticated remote root command execution.
The setup wizard exposes a privileged diagnostic chain
When the router is in its factory or setup wizard state, meaning wizard_finish is not set (out of box or immediately after a factory reset), the URL /wizard/apply.cgi is served without authentication. That route is dispatched by the same POST handler and gozila action table as the authenticated /apply.cgi. This shared dispatch exposes the Diagnostics actions start_ping and start_traceroute to an unauthenticated requester.
The ping_ip and traceroute_ip parameters are written to NVRAM verbatim. The diagnostic service daemons then read those stored values, construct a shell command, and invoke system() with the untrusted input embedded.
Why the input gates do not stop the injection
The only input gate on the dispatch side is an [A-Za-z0-9._] whitelist applied to submit_button. That is a character check rather than authorization, and it does not sanitize the diagnostic target values. The daemon blacklist blocks only the space, pipe, and greater than characters; it does not block semicolon, dollar sign, ampersand, or open parenthesis. So ${IFS} supplies whitespace and multi command injection succeeds.
A getaddrinfo() precheck on the hostname is satisfied with an A record served from attacker controlled DNS. Because uClibc does not reject shell metacharacters in hostnames, the resolution step does not eliminate the injection path.
Attack flow
- The attacker reaches the setup wizard while initial configuration remains unfinished.
- An HTTP POST selects a Diagnostics action and supplies a manipulated
ping_iportraceroute_ipvalue. - The handler stores the value verbatim in NVRAM.
- A diagnostic service process retrieves the value, builds a shell command, and calls
system()with the injected input, running arbitrary commands as root.
Boundary controls that confirm the finding
Two controls show that the defect is specifically the pre-auth reachability through the setup wizard. In the same setup state, the identical POST to /apply.cgi without the wizard/ prefix redirects to the setup page (HTTP 302 to /index.asp), blocked as designed. Once wizard_finish is set to 1, /wizard/apply.cgi requires authentication. Completing setup changes the authentication requirement, but it does not repair the underlying shell execution sink.
Scoring
VulDB reports a CVSS v3 base score of 10.0. NVD displays VulDB's CVSS v4.0 Base plus Threat score of 9.3 (Critical) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P, and NIST has not supplied its own assessment. The original researcher scored the issue CVSS v3.1 8.8 using AV:A and unchanged scope, while the CNA record uses AV:N and changed scope. The records do not reconcile these assumptions, so the device's actual network reachability and setup state remain essential context when you interpret severity.
Proof of Concept
A viable public proof of concept exists, and three independent sources corroborate it: the NVD record (which states "The exploit is now public and may be used"), VulDB VDB-431044 (Access: Public, Status: Proof-of-Concept), and the researcher's GitHub repository Zimo-666/E5350-cves, directory 01-wizard-preauth-command-injection. The README still carries a CVE-TBD heading, but NVD and VulDB both bind that disclosure to CVE-2026-121932.
The non destructive PoC request has these preconditions: the router is in factory or wizard state, with no credentials and no session.
POST /wizard/apply.cgi HTTP/1.1 Host: <ROUTER_IP> Content-Type: application/x-www-form-urlencoded submit_button=Diagnostics&submit_type=start_ping&change_action=gozila_cgi&gui_action=Apply&commit=1&ping_times=5&ping_size=64&ping_ip=y%3Bcd%24%7BIFS%7D..%3Bcd%24%7BIFS%7Dtmp%3Btouch%24%7BIFS%7De5350_pwned2%3By
The ping_ip value URL decodes to y;cd${IFS}..;cd${IFS}tmp;touch${IFS}e5350_pwned2;y, where y resolves via attacker controlled DNS so the getaddrinfo() precheck passes before the injected commands run.
Observed results on rehosted firmware under QEMU user mode, with wizard_finish=0 and an empty credential store:
HTTP 200with the 28,748 byte Diagnostics page, and no authentication challenge.- NVRAM store log:
SET ping_ip=y;cd${IFS}..;cd${IFS}tmp;touch${IFS}e5350_pwned2;y - Marker file
/tmp/e5350_pwned2created by the injected shell commands. - Syscall trace of the execution chain via the authenticated path:
execve("/bin/sh",{"sh","-c","ping -c 5 -s 64 -o /tmp/ping.log y;cd${IFS}..;cd${IFS}tmp;touch${IFS}e5350_pwned2;y &"})
The identical POST to /apply.cgi without the wizard/ prefix returns HTTP 302 -> /index.asp in the same state, and after setup completion (wizard_finish=1) /wizard/apply.cgi requires authentication. This shows that the defect is the pre-auth reachability through the setup wizard.
The traceroute_ip parameter under submit_type=start_traceroute is an equivalent injection vector. The researcher reviewed and documented the PoC with runtime evidence and boundary controls (discovery dated 2026-10-11 via Ghidra static analysis plus QEMU dynamic verification), but did not independently execute it here. The repository notes this is a per product filing, distinct from related CyberTAN lineage CVEs (CVE-2013-3307, CVE-2013-10058, CVE-2024-48286) and from the unrelated E5350 CVE-2022-35572.
Affected Systems and Versions
- Product: Linksys E5350 router (AC1000 WiFi 5 home router).
- Affected firmware: 1.0.00.037, released May 17, 2022, identified as the latest and last release. The product is end of life.
- Hardware revision note: The firmware 1.0.00.037 release notes identify E5350v1. The AC1000 datasheet references E5350v4, so do not extend the affected version claim across every hardware revision without verification.
- Vulnerable components: The CyberTAN derived
httpdweb server and thediag_pingbutton/diag_tracertbuttonservice binaries. - Exposure condition: Devices in the factory or unfinished setup state (
wizard_finishnot set), including out of box units and any device returned to that state by a factory reset. The unauthenticated path is reachable on the LAN, and conditionally on the WAN side for ISP deployed units reachable during setup.
Vendor Security History
Linksys has a documented and mixed security history. IOActive's Smart WiFi research, disclosed in January 2017, reported ten vulnerabilities, six of which were remotely exploitable without authentication, alongside findings of authenticated root command execution. In that case the researchers reported that Linksys was proactively publishing an advisory and temporary solutions pending firmware.
For the E5350 specifically, CVE-2022-35572 described disclosure of WiFi credentials and other device information through the management interface, with Internet exploitation dependent on remote management being enabled. The researcher reported that firmware 1.0.00.037 remained vulnerable after the May 2022 release. That earlier case concerns the same model and firmware number but a separate mechanism, and it does not establish a combined exploit chain with the current CVE.
The contrast is instructive. The IOActive case documents a cooperative vendor response, while NVD and VulDB state that the vendor was contacted early about CVE-2026-121932 but did not respond in any way, and no fixed version is specified.
References
- NVD: CVE-2026-121932
- MITRE CVE Record (CVE Services API)
- VulDB VDB-431044: Linksys E5350 apply.cgi system OS command injection
- VulDB CVE entry CVE-2026-121932
- VulDB submission 1024275
- VulDB submission 1024277
- VulDB VDB-431044 CTI
- Researcher disclosure: Zimo-666/E5350-cves, 01-wizard-preauth-command-injection
- Researcher README (raw)
- Linksys E5350 Password Disclosure (CVE-2022-35572)
- E5350v1 1.0.00.037 Customer Release Notes
- E5350 AC1000 Datasheet
- IOActive: Linksys Smart WiFi Vulnerabilities
- OffSeq Threat Radar: CVE-2026-121932
- CISA Known Exploited Vulnerabilities Catalog search
- Linksys
