Linksys E1700: OS command injection in setLinksysIpv6 handler
Summary
The web management handler /goform/setLinksysIpv6 of the Linksys E1700 router with firmware 1.0.0.4.003 does not validate the _6rd_prefix and _6rd_prefix_len parameters. A remote attacker can send a crafted request to inject operating system commands and run them on the device with the router's privileges. A public proof of concept exists, the vendor did not respond to the early disclosure, and no fix has been confirmed.
Affected
- Linksys E1700 with firmware 1.0.0.4.003
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed firmware has been confirmed.
Workaround
- Do not expose the router's web/admin interface to the internet and close any port forwarding to it.
- Restrict admin access to a trusted LAN segment and disable remote management.
- Change default admin credentials.
- Monitor the router and firewall logs for unexpected outbound connections from the device.
Exploitation
- Public proof of concept: Yes (reporter write-up and VulDB entry).
- Exploited in the wild: Unknown. No CISA KEV listing was found.
- CISA SSVC: Exploitation poc, Automatable no, Technical Impact total.
Our recommendation
- Inventory all Linksys E1700 devices, including those at small offices and remote sites.
- Confirm that no admin interface or port forward is reachable from the internet.
- Restrict admin access to a trusted network segment and change credentials.
- Plan replacement with a supported device and check for vendor updates periodically.
- Re-check the NVD, the VulDB entry and the Linksys support page for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry vuldb.com
- Reporter write-up (GitHub) github.com
- CVE JSON record (CVE List V5) raw.githubusercontent.com
- Linksys E1700 firmware release notes 1.0.04 downloads.linksys.com
- HOL Guard CVE entry hol.org
- SecurityFocus CVE entry www.securityfocus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:50.
Original description (NVD)
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.