AI analysis
Claude Opus · 7 Nov 2026, 10:20 CET
Linksys E5350 firmware flaw lets remote attackers run system commands
Linksys E5350 firmware 1.0.00.037 has an OS command injection flaw in /wizard/apply.cgi, rated CVSS 3.1 10.0. A public exploit exists, no fix is listed and the vendor has not responded, so restrict management access and plan to replace exposed devices.
In plain terms
The Linksys E5350 running firmware version 1.0.00.037 contains a flaw in its web-based setup wizard. Two settings meant for network diagnostics, a ping target and a traceroute target, are passed to the device's operating system without proper checks. This is called OS command injection: an attacker hides their own commands inside an input field, and the device runs them.
According to the record, an attacker can do this remotely, without logging in and without any action from the device owner. In practice, someone who can reach the device's management interface could take full control of it. Anyone who uses this Linksys model, whether at home, in a small office or in a branch location, should treat it as at risk until the vendor publishes a fix or the device is replaced.