Is CVE-2026-121930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121930 being exploited in the wild.

How severe is CVE-2026-121930?

Critical severity, with a CVSS score of 9.1, published 4 November 2026.

Which products and versions are affected?

Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006.

How is CVE-2026-121930 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-121930?

Check whether you run Linksys WRT54GL Wireless-G Broadband Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121930: Linksys WRT54GL OS command injection in Ping Diagnostic

CVE-2026-121930 · Severity: critical · CVSS 9.1 · Published 2026-11-04

The Linksys WRT54GL wireless router allows authenticated attackers to execute arbitrary commands with root privileges through the web-based Ping Diagnostic feature. If remote management is enabled or default credentials are in use, an attacker can fully compromise the device, intercept traffic, or use it as a pivot point to attack the connected network. This product is end-of-life and will not receive security patches.

Vendors: Linksys.

Quick answers

Is CVE-2026-121930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121930 being exploited in the wild.
How severe is CVE-2026-121930?: Critical severity, with a CVSS score of 9.1, published 4 November 2026.
Which products and versions are affected?: Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006.
Is there a fix for CVE-2026-121930?: No fixed version is recorded yet. Disable remote management if not required, and change default credentials (empty username and "admin" password) to a strong authentication pair. However, since this product is end-of-life with no vendor support, users should consider replacing the device with a maintained router model. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121930 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121930?: Check whether you run Linksys WRT54GL Wireless-G Broadband Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable remote management if not required, and change default credentials (empty username and "admin" password) to a strong authentication pair. However, since this product is end-of-life with no vendor support, users should consider replacing the device with a maintained router model.

Technical details

An OS command injection vulnerability exists in the Ping Diagnostic function (apply.cgi) where the ping_ip parameter is passed unsanitized through multiple insufficient filters before being executed by system() as root. The attack requires HTTP Basic authentication but exploits default credentials (empty username, "admin" password) that remain widely deployed. The vulnerability chains multiple weak blacklist filters and can bypass IP validation checks, allowing attackers to inject commands like `192.168.1.100;touch${IFS}injOK_ping` to achieve arbitrary code execution.

Affected products

Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006

Timeline

2026-11-04: disclosed: Vulnerability advisory published on NVD
2026-10-10: other: Discovered via static analysis and dynamic verification
2026-10-11: other: Vendor notified but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.