PatchSiren

Linksys CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Linksys CVE published 2026-10-12

CVE-2026-108896

A vulnerability was found in Linksys E1700 1.0.0.4.003, affecting the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection, allowing remote attackers to execute arbitrary commands. This vulnerability has a significant impact on the security of affected systems, emphasizing the need for prompt assessment and [truncated]

CRITICAL Linksys CVE published 2026-10-12

CVE-2026-108895

A weakness has been identified in Linksys E1700 1.0.0.4.003, specifically in the setDMZ function of the /goform/setDMZ file, which can lead to os command injection when manipulating the MAC_addr argument. This vulnerability can be exploited remotely. The vendor, Linksys, was contacted but did not respond. The vulnerability allows for remote os command injection, posing a critical risk to affected devices. [truncated]

CRITICAL Linksys CVE published 2026-10-12

CVE-2026-108894

A critical vulnerability has been discovered in the Linksys E1700 router, specifically in the addStaticRoute function of the Static Route Handler. This flaw allows for OS command injection, enabling remote attackers to execute arbitrary commands on the device. The vulnerability has a CVSS score of 9.4 and is considered critical. Network administrators and security teams should assess exposure and apply re [truncated]

CRITICAL Linksys CVE published 2026-10-12

CVE-2026-108892

A stack-based buffer overflow vulnerability was determined in Linksys E1700 1.0.0.4.003, affecting the ssid1MACFilter function of the Mac Filter component. The vulnerability can be exploited remotely by manipulating the newap_text_%d argument. The exploit has been publicly disclosed, and the vendor was contacted but did not respond. This vulnerability could lead to potential unauthorized access and disrup [truncated]

HIGH Linksys CVE published 2026-09-07

CVE-2026-86299

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.