Critical OS Command Injection Flaw Found in Linksys E1700 Firmware
A CVSS 9.4 vulnerability in Linksys E1700 firmware allows remote command injection via static route settings, with public exploits available.
Key points
- CVE-2026-108894 allows remote OS command injection in Linksys E1700 version 1.0.0.4.003.
- The flaw resides in the addStaticRoute function within the Static Route Handler component.
- Public exploit code is available, and the vendor did not respond to early contact.
A critical security vulnerability has been identified in the Linksys E1700 router, specifically affecting firmware version 1.0.0.4.003. The flaw, tracked as CVE-2026-108894, permits remote attackers to inject operating system commands through the device’s static route configuration interface.
At a glance
- CVE
- CVE-2026-108894
- Product
- Linksys E1700
- CVSS
- 9.4 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The vulnerability carries a CVSS score of 9.4, rated as critical. It stems from improper input validation in the addStaticRoute function located in the /goform/addStaticRoute file. Attackers can manipulate specific arguments related to IP address, netmask, gateway, and metric settings to execute arbitrary commands on the router.
Technical Details and Context
According to the National Vulnerability Database record, the issue involves weaknesses classified as CWE-78 and CWE-77, which relate to OS command injection. The affected component is the Static Route Handler. By crafting malicious requests that target the staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting arguments, an attacker can bypass normal processing and inject shell commands.
Remote exploitation of this attack vector is possible. This means an attacker does not need physical access to the device or credentials to potentially compromise the system, provided they can reach the web interface handling these requests. The specific manipulation of these four parameters directly leads to the execution of unauthorized operating system commands.
Vendor Response and Exposure
The vendor was contacted early regarding this disclosure but did not respond in any way, according to the NVD record. Consequently, no patch or security update has been confirmed for this specific firmware version. The lack of vendor engagement leaves users of this specific build without an official remediation path from the manufacturer.
Furthermore, the exploit code for this vulnerability has been released to the public. This significantly increases the risk, as the tools needed to abuse the flaw are now readily available for use in attacks. The combination of a critical severity rating, remote exploitability, and public code availability creates a high-risk scenario for affected devices.
What should you do?
Network administrators and users should immediately verify if they are running Linksys E1700 firmware version 1.0.0.4.003. If this version is in use, the device is vulnerable to remote command injection. Since no fix has been confirmed, isolating the device from the internet or disabling remote management features may reduce exposure until further notice.
What to do and how to stay safe: Linksys
- Check your router’s firmware version and compare it against the affected version 1.0.0.4.003 listed in the vulnerability record.
- Disable remote administration features on the device to prevent external attackers from accessing the static route configuration interface.
- Monitor network traffic for unusual outbound connections or commands that may indicate exploitation of the OS command injection flaw.
- Once the vendor provides an update, apply the security patch immediately to resolve the vulnerability in the Static Route Handler.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108894?
It is a critical OS command injection vulnerability in Linksys E1700 firmware version 1.0.0.4.003, allowing remote attackers to execute commands via static route settings.
Is there a patch available for this flaw?
No, the vendor did not respond to early contact, and no fix or update has been confirmed for this vulnerability.
How can an attacker exploit this vulnerability?
Attackers can remotely manipulate arguments in the static route configuration, such as IP and gateway settings, to inject and execute operating system commands.
