Is CVE-2026-121932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121932 being exploited in the wild.

How severe is CVE-2026-121932?

Critical severity, with a CVSS score of 10, published 4 November 2026.

How is CVE-2026-121932 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-121932?

Check whether you run Linksys E5350 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121932: Linksys E5350 OS command injection in /wizard/apply.cgi

CVE-2026-121932 · Severity: critical · CVSS 10 · Published 2026-11-04

The Linksys E5350 router is vulnerable to remote command execution during its initial setup phase, before the owner has configured a password. An attacker on the network can manipulate diagnostic parameters to inject arbitrary OS commands that execute as root, allowing them to install malware, steal credentials, or enroll the device in a botnet when it is most exposed.

Vendors: Linksys.

Quick answers

Is CVE-2026-121932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121932 being exploited in the wild.
How severe is CVE-2026-121932?: Critical severity, with a CVSS score of 10, published 4 November 2026.
Which products and versions are affected?: Linksys E5350 1.0.00.037.
Is there a fix for CVE-2026-121932?: No fixed version is recorded yet. Complete the router setup wizard immediately after initial boot to set a password and enable authentication on configuration endpoints. If the device is deployed in an ISP-provisioned or managed state, ensure it is isolated from untrusted networks during the setup phase.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121932 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121932?: Check whether you run Linksys E5350 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Complete the router setup wizard immediately after initial boot to set a password and enable authentication on configuration endpoints. If the device is deployed in an ISP-provisioned or managed state, ensure it is isolated from untrusted networks during the setup phase.</anigation> </invoke>

Technical details

The vulnerability chains missing authentication (CWE-306) with OS command injection (CWE-78) in the /wizard/apply.cgi endpoint. While the router is in factory or post-reset state (wizard_finish flag unset), the endpoint is served without authentication and dispatches the same action handlers as the authenticated /apply.cgi, including Diagnostics functions that execute ping_ip and traceroute_ip parameters unsanitized via system() calls. The injected shell metacharacters (;, $, (, etc.) bypass a weak blacklist that only blocks space, pipe, and redirect operators.

Affected products

Linksys E5350 1.0.00.037

Timeline

2026-11-04: disclosed
2026-11-04: exploited: exploit is public

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.