AI analysis
Claude Opus · 7 Nov 2026, 10:20 CET
Command injection in end-of-life Linksys WRT54GL traceroute diagnostic
A publicly disclosed OS command injection flaw affects the Linksys WRT54GL 4.30.18 router's traceroute diagnostic function. It can be triggered remotely and allows command execution. The device is no longer supported, so no vendor fix is expected.
In plain terms
The Linksys WRT54GL is an older home and small-office wireless router. A flaw in its built-in network diagnostic feature (the traceroute tool reached through its web interface) lets an attacker smuggle operating system commands into a field that should only hold an IP address. When the router runs that input, the attacker's commands run too.
Anyone still running this router should care, because a successful attack can give full control of the device. The product is no longer supported by the manufacturer, so a patch is unlikely. The exploit has already been published, increasing the chance it will be reused.