Linksys E5350, CVE-2026-121932: a new CVE scored 10

The bottom line

Owners of a Linksys E5350 on firmware 1.0.00.037 should act now: the exploit is public, no patch exists, and the vendor has not responded. Check first whether the router's admin interface is reachable from outside the local network, and restrict it if so.

Free analysis report · 8 pagesLinksys E5350, CVE-2026-121932: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker who can reach the router's web interface can inject operating system commands by supplying crafted values in the ping_ip or traceroute_ip fields of the diagnostic endpoint. The record says the attack can be initiated remotely.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• No patch means nothing can be done. Without a patch, reducing exposure is the available action: disable remote admin access and ensure the router's web interface is not reachable from outside the local network.
• Being behind NAT means the router's admin interface cannot be reached remotely. Many routers expose a remote management option on the WAN port independently of NAT. Confirm the setting in the admin panel rather than assuming it is off.

How we would triage it

This is our judgement.

Step 1: Find the firmware version running on the E5350

• Log in to the router's admin interface and go to the status or firmware page. The record names 1.0.00.037 as the affected version — confirm whether this matches what is installed.

Step 2: Check and restrict remote admin access

• In the router's admin settings, find the remote management or remote access option. If it is enabled and the WAN interface is exposed, disable it. The record says the attack can be initiated remotely.

Step 3: Monitor for a firmware update

• The record names no fixed version and no vendor advisory exists. Check the Linksys support page for the E5350 regularly for any new firmware release.
• If no update appears and the device handles internet-facing traffic, consider whether a replacement router is the appropriate next step.

Step 4: Review the router if the admin interface was exposed

• If remote access was enabled and internet-facing, review connected devices for unexpected activity. The record identifies this as OS command injection (CWE-78, CWE-77) affecting the router's web interface.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

We are reviewing CVE-2026-121932, an OS command injection flaw (CWE-78, CWE-77) in the Linksys E5350 router on firmware 1.0.00.037. The exploit is public, no patch has been released, and the vendor did not respond to disclosure. Please confirm: (1) whether we run a Linksys E5350 and on which firmware version; (2) whether the router's admin interface is reachable from outside our network; and (3) if so, that remote admin access has been disabled. As no fixed version exists, please also confirm you are monitoring for any update. Please provide written confirmation of the version installed and current remote-access setting by 12 November 2026.

The weakness behind it

The record classes this as CWE-78 and CWE-77.

• CWE-78 →What this kind of mistake is, and which exploited vulnerabilities share it.
• CWE-77 →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

The CVE record:

A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Versions of Linksys E5350 the record lists as affected:

• 1.0.00.037

The record gives no version ranges. Use the vendor's advisory for the affected versions.

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-121932

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same id can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-121932

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• No fixed firmware version is named in the record or any source. It is not known whether Linksys intends to release a patch.
• The record does not state whether authentication is required to reach the vulnerable endpoint, which would affect how easily the flaw can be exploited.
• It is not known whether Linksys E5350 firmware versions other than 1.0.00.037 are also affected; the record names only that version.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 5 November 2026. We have not read the vendor's advisory page and we have not tested it.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.