Is CVE-2026-121931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121931 being exploited in the wild.

How severe is CVE-2026-121931?

Critical severity, with a CVSS score of 9.1, published 4 November 2026.

Which products and versions are affected?

Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006.

Is there a fix for CVE-2026-121931?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-121931 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-121931?

Check whether you run Linksys WRT54GL Wireless-G Broadband Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121931: Linksys WRT54GL OS command injection in Traceroute diagnostic

CVE-2026-121931 · Severity: critical · CVSS 9.1 · Published 2026-11-04

The Linksys WRT54GL wireless router contains a command injection flaw in its web management interface's Traceroute diagnostic function. An authenticated attacker can inject arbitrary OS commands that execute with root privileges, allowing full compromise of the device including configuration tampering, traffic interception, and installation of persistent backdoors. Factory-default credentials (empty username with password "admin") are widely used, and if remote management is enabled, the attack is possible from the internet.

Vendors: Linksys.

Quick answers

Is CVE-2026-121931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121931 being exploited in the wild.
How severe is CVE-2026-121931?: Critical severity, with a CVSS score of 9.1, published 4 November 2026.
Which products and versions are affected?: Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006.
Is there a fix for CVE-2026-121931?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121931 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121931?: Check whether you run Linksys WRT54GL Wireless-G Broadband Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The apply.cgi handler fails to properly sanitize the traceroute_ip parameter before passing it to a shell command executed via system() as root. The vulnerability requires HTTP Basic authentication and an active WAN link (normal operating state), but the XSS blacklist filter permits semicolons, dollar signs, and curly braces, enabling command injection via constructs like ;touch${IFS}injOK_tr2. The payload is limited to approximately 30 bytes due to a 80-byte buffer constraint, but this is sufficient for compact commands or multi-stage exploits.

Affected products

Linksys WRT54GL Wireless-G Broadband Router 4.30.18 build 006

Timeline

2026-11-04: disclosed: Vulnerability publicly disclosed
2026-10-10: other: Vulnerability discovered via static and dynamic analysis
2026-10-11: other: Vendor notified; no response received

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.