Linksys E1700 Users Face Remote OS Command Injection Risk as Vendor Ignores CVE-2026-108896 Disclosure
A critical vulnerability in Linksys E1700 firmware allows remote OS command injection via IPv6 inputs, with no vendor response or fix confirmed.
Key points
- CVE-2026-108896 affects Linksys E1700 firmware version 1.0.0.4.003.
- The flaw enables remote OS command injection through the setLinksysIpv6 function.
- The vendor was contacted early but did not respond to the disclosure.
A critical remote code execution vulnerability has been identified in Linksys E1700 routers running firmware version 1.0.0.4.003. The flaw, tracked as CVE-2026-108896, allows attackers to inject operating system commands remotely by manipulating specific IPv6 configuration arguments.
At a glance
- CVE
- CVE-2026-108896
- Product
- Linksys E1700
- CVSS
- 9.4 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The vulnerability resides in the setLinksysIpv6 function within the /goform/setLinksysIpv6 file. According to the National Vulnerability Database record, manipulating the _6rd_prefix or _6rd_prefix_len arguments results in OS command injection. This weakness is classified under CWE-78 and CWE-77, indicating improper neutralization of special elements in OS commands.
Disclosure and Vendor Response
The exploit code for this vulnerability has been made public and could be used. The researcher who discovered the flaw contacted the vendor early in the disclosure process. However, the vendor did not respond in any way to the notification.
No patch or firmware update has been confirmed by Linksys to address this issue. The NVD record lists the CVSS score as 9.4, rating the severity as critical. Another record for the same CVE lists the score as 8.6, rating it as high. Both records describe the same remote OS command injection mechanism.
Affected Systems
The vulnerability specifically affects Linksys E1700 routers running firmware version 1.0.0.4.003. Users of this specific firmware version are exposed to remote attacks. The attack can be launched remotely, as stated in the vulnerability description.
The lack of vendor response leaves users without an official mitigation path. The public availability of the exploit increases the risk of automated scanning and targeted attacks against devices running this firmware.
What should you do?
Security professionals should verify if their Linksys E1700 devices are running the affected firmware version. If the version matches 1.0.0.4.003, the device is vulnerable to remote code execution. Organizations should consider isolating these devices from untrusted networks until a patch is available.
Monitoring network traffic for unusual IPv6 configuration requests may help detect exploitation attempts. Since no fix has been confirmed, reducing the attack surface by restricting access to the router's administration interface is a prudent temporary measure.
What to do and how to stay safe: Linksys
- Verify the firmware version of all Linksys E1700 routers to check for 1.0.0.4.003.
- Restrict remote access to the router's web interface to trusted IP addresses only.
- Monitor network logs for unusual activity related to IPv6 configuration changes.
- Isolate affected devices from critical network segments until a vendor patch is released.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108896?
It is a critical vulnerability in Linksys E1700 firmware that allows remote OS command injection via IPv6 input manipulation.
Is there a patch for this vulnerability?
No patch has been confirmed by the vendor, who did not respond to the initial disclosure.
Which firmware version is affected?
Linksys E1700 firmware version 1.0.0.4.003 is affected by this vulnerability.
