Linksys E1700: OS command injection in setDMZ function
Summary
The web management interface of the Linksys E1700 router (firmware 1.0.0.4.003) does not validate the MAC_addr parameter of the /goform/setDMZ function. An authenticated attacker with low privileges can inject operating system commands remotely, which the public proof of concept demonstrates by starting a telnet shell on the device. The impact on confidentiality, integrity and availability is rated high, and the exploit is publicly available.
Affected
- Linksys E1700, firmware 1.0.0.4.003
- Function setDMZ at /goform/setDMZ, parameter MAC_addr
Fixed in
Unknown. No vendor advisory or patched firmware was found.
Workaround
- Remove remote management from the WAN interface and disable it.
- Do not expose the router's web interface to the internet.
- Place the device behind a firewall and restrict access to the management interface to trusted hosts.
Exploitation
- Public proof of concept available (VulDB status: Proof-of-Concept, CISA SSVC: Exploitation poc).
- Automatable: no (CISA SSVC).
- Known exploited in the wild: no evidence found.
Our recommendation
- Check whether any Linksys E1700 is in use and whether its management interface is reachable from the internet or untrusted networks.
- Isolate or replace affected devices, since no fix is confirmed.
- Check the Linksys website for firmware updates and monitor for vendor advisories.
- Monitor the router for unexpected outbound connections or unknown listening services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry CVE-2026-108895 vuldb.com
- GitHub proof of concept (wudipjq/my_vuln) github.com
- VulDB CVE record vuldb.com
- VulDB CTI vuldb.com
- SecurityFocus CVE record www.securityfocus.com
- Linksys E1700 firmware release notes 1.0.04 downloads.linksys.com
- Linksys website www.linksys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:48.
Original description (NVD)
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.