Critical OS Command Injection Flaw Found in Linksys E1700 Firmware
A CVSS 9.4 critical vulnerability in Linksys E1700 firmware allows remote OS command injection via the DMZ function, with no vendor response reported.
Key points
- CVE-2026-108895 is a critical OS command injection flaw in Linksys E1700 version 1.0.0.4.003.
- The vulnerability resides in the setDMZ function and allows remote attackers to inject operating system commands.
- Public exploit code is available, and the vendor has not responded to disclosure attempts.
A critical OS command injection vulnerability has been identified in the Linksys E1700 router, specifically affecting firmware version 1.0.0.4.003. The flaw, tracked as CVE-2026-108895, carries a CVSS score of 9.4, rating it as critical severity according to the National Vulnerability Database.
At a glance
- CVE
- CVE-2026-108895
- Product
- Linksys E1700
- CVSS
- 9.4 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The vulnerability exists within the setDMZ function located in the /goform/setDMZ file. Attackers can manipulate the MAC_addr argument to trigger an operating system command injection. This manipulation allows for remote execution of injected commands on the device.
Technical Context and Disclosure Status
The National Vulnerability Database records the weakness as involving CWE-78 and CWE-77. The specific vector involves the improper handling of the MAC address argument passed to the DMZ configuration function.
According to the NVD record, the vendor was contacted early regarding this disclosure. However, the vendor did not respond in any way to the initial outreach. This lack of communication has left the status of a potential fix unknown.
Exposure and Threat Landscape
The exploit for this vulnerability has been made available to the public. The availability of public exploit code increases the risk of attacks against devices running the affected firmware. Any device connected to the internet that is running Linksys E1700 firmware version 1.0.0.4.003 is potentially exposed to remote exploitation.
Because the attack can be executed remotely, threat actors can target the device from outside the local network. The critical nature of the flaw means that successful exploitation could allow an attacker to execute arbitrary operating system commands on the device.
What should you do?
Security professionals and users should verify the firmware version of their Linksys E1700 routers immediately. If the device is running version 1.0.0.4.003, it is vulnerable to this critical command injection flaw. Since the vendor has not provided a response or a patch, users should consider isolating the device from the internet or replacing it if possible.
What to do and how to stay safe: Linksys
- Check the firmware version of your Linksys E1700 router to see if it matches the vulnerable version 1.0.0.4.003.
- Disable remote management features on the router to reduce the attack surface for remote exploitation attempts.
- Segment the router from sensitive internal networks to limit potential lateral movement if the device is compromised.
- Monitor network traffic for unusual outbound connections that might indicate a successful exploit or command injection.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108895?
It is a critical OS command injection vulnerability in Linksys E1700 firmware version 1.0.0.4.003 that allows remote command injection.
Is there a patch available for this vulnerability?
No, the vendor has not responded to disclosure attempts, and no fix has been confirmed or released yet.
How can an attacker exploit this flaw?
Attackers can remotely manipulate the MAC_addr argument in the setDMZ function to inject operating system commands.
