EUVD-2026-97436
GHSA-j99r-fjcg-jggx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach E1700 web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitPOST crafted staticRoute parameters to /goform/addStaticRoute
-
ExecutionShell metacharacters injected into command
-
PersistArbitrary OS command executes on router
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the E1700 HTTP management interface and an authenticated session at low privilege (CVSS PR:L), targeting the Static Route Handler feature via /goform/addStaticRoute. The specific prerequisite is the ability to submit static-route parameters (staticRoute_IP_setting / staticRoute_Netmask_setting / staticRoute_Gateway_setting / staticRoute_Metric_setting) with injected shell metacharacters. Limiting factors: valid credentials are needed (not fully unauthenticated), the management interface must be accessible to the attacker (typically LAN-side by default, far less exposed if WAN-side remote management is disabled), and the device must run the affected 1.0.0.4.003 firmware; no official patch is available since the vendor did not respond to disclosure. |
| Impact | This is a credible but context-dependent priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable OS command injection (CWE-78) in the Linksys E1700 web interface, and PR:L confirms authentication is required rather than fully unauthenticated access. A public exploit exists (VulDB-referenced GitHub PoC) and the vendor did not respond to disclosure, so no official patch is indicated - both factors raise practical risk. However, this is NOT confirmed actively exploited: it is absent from CISA KEV, and the vector's E:P (Proof-of-Concept) exploit-maturity flag aligns with 'exploit code exists' rather than 'in-the-wild use.' No EPSS score was provided, so widespread-exploitation probability cannot be quantified. The VC:H/VI:H/VA:H/SC:H/SI:H/SA:H impact rating from VulDB appears aggressive - it treats compromise of the router as cascading into subsequent systems; command execution on the device is realistic, but the subsequent-system 'H' ratings should be verified. Net: a real, exploitable flaw with public PoC and no vendor fix, tempered by an authentication requirement and a small, consumer-grade deployment footprint - moderate-to-high priority for anyone running this specific device exposed to its management interface, low broad-internet systemic risk. |
| Exploit ScenarioDerived | An attacker who can reach the E1700 management interface and has (or obtains via default/weak credentials) a low-privileged authenticated session sends a crafted request to /goform/addStaticRoute, injecting shell metacharacters into the staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting parameters. The injected command runs in the router's OS context, yielding device takeover. A public proof-of-concept for this exact endpoint is already available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbitrary OS commands on the device via crafted input to the static route parameters in /goform/addStaticRoute. Publicly available exploit code exists, increasing the risk of exploitation; no vendor patch has been released as Linksys did not respond to the disclosure. The vulnerability requires network access to the management interface and valid credentials, but successful exploitation grants full control of the router.
RemediationAI
No vendor-released patch is available at time of analysis; Linksys did not respond to the disclosure. As a compensating control, immediately restrict access to the router's web management interface to trusted networks only-disable WAN-side remote management if enabled and ensure the interface is not exposed to the internet. Change default administrative credentials to strong, unique passwords and consider disabling the static route feature if not required (though this may not be possible without firmware modification). Network segmentation and firewall rules should prevent untrusted hosts from reaching the management interface. Monitor router logs for unexpected static route additions or command execution attempts. Given the public exploit and lack of vendor support, replacing the device with a supported model is recommended for long-term security.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an OS command injection (CWE-78) in the addStaticRoute function of the Linksys E1700's web management interface. The function fails to properly sanitize user-supplied arguments (staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, staticRoute_Metric_setting) before passing them to a system shell, allowing an attacker to inject arbitrary commands. The affected component is the Static Route Handler accessible via the /goform/addStaticRoute endpoint. According to the CPE (cpe:2.3:a:linksys:e1700:*:*:*:*:*:*:*:*), the E1700 model is affected, with confirmed exploitation on firmware 1.0.0.4.003. This type of flaw is common in embedded devices where web interfaces invoke shell commands without input validation.
Know when E1700 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable web endpoint (AV:N) with low complexity (AC:L) but requiring an authenticated session (PR:L); command injection yields full device confidentiality, integrity, and availability impact within the router's own scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-78 (OS command injection) in the addStaticRoute function of the binary modform.so, reachable through the HTTP endpoint /goform/addStaticRoute on the Linksys E1700 web management interface.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Linksys E1700 routers running firmware 1.0.0.4.003 are exposed to a high-severity command injection flaw in their web management interface that lets an attacker with network access and valid credentials seize full control of the device. Because publicly available exploit code exists and Linksys has not released a fix, every unretired E1700 still serving as a network edge or branch gateway is a standing risk to the confidentiality and integrity of everything behind it. Leadership should care because these devices often sit at trust boundaries, so a single compromised unit can become a pivot point into the broader corporate network.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WAN/remote management and UPnP, restrict the management interface to a trusted VLAN or allowlisted hosts, enforce strong unique administrative credentials, monitor and block POST requests to /goform/addStaticRoute, review static route configuration for unauthorized entries, and prioritize replacement of the affected device.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an at
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell c
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an a
Exploit-DB