EUVD-2026-97470
GHSA-4jv4-xw7r-ghwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted POST to /goform/setLinksysIpv6
-
ExploitInject shell metacharacters via _6rd_prefix
-
ExecutionExecute arbitrary OS commands on device
-
ImpactFull router compromise and traffic interception
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's HTTP management interface and a low-privilege authenticated session (CVSS PR:L), targeting the setLinksysIpv6 handler at /goform/setLinksysIpv6 via the _6rd_prefix and _6rd_prefix_len parameters (the 6rd/IPv6 configuration feature). No user interaction is needed (UI:N). Limiting factors: valid credentials (or default/weak credentials) are required, and the management interface must be reachable by the attacker - on default configurations this is typically LAN-only, so WAN-side exploitation depends on remote management being enabled or the attacker having an internal foothold. Affected firmware is specifically E1700 1.0.0.4.003; no patched version is available. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L = authenticated), scoring 8.6 with high confidentiality/integrity/availability impact. This is an OS command injection (CWE-78), which for an embedded router typically yields full device compromise. Signal cross-reference: POC exploit code is publicly available (VulDB-referenced GitHub PoC), but the CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - public exploit availability and active exploitation are distinct signals. The vector's E:P (Proof-of-Concept exploit maturity) is consistent with the PoC-but-not-weaponized status. Note a tension to verify: the input 4.0 vector claims subsequent-system impact SC:H/SI:H/SA:H, implying a scope change beyond the vulnerable device; for a single-device command injection this is likely an overstatement by the source (VulDB) and should be treated cautiously. Realistically this is a genuine but moderate priority: authentication is required (PR:L limits mass exploitation), the vendor did not respond and no patch exists, so compensating controls are the only mitigation. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to the Linksys E1700 web interface (reachable over the network, including exposed-management scenarios) sends a crafted request to /goform/setLinksysIpv6 with a malicious _6rd_prefix or _6rd_prefix_len value. The injected shell metacharacters are passed unsanitized to an OS command, executing attacker-controlled commands on the router. A public proof-of-concept exists (GitHub, wudipjq/my_vuln), lowering the barrier to reliable exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 12, 2026
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003) lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by manipulating the _6rd_prefix and _6rd_prefix_len parameters handled by setLinksysIpv6 at /goform/setLinksysIpv6. The flaw scores 8.6 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N, E:P) and 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact on the router. Publicly available exploit code exists - including a published proof-of-concept write-up referenced from the CVE record - but there is no confirmed actively exploited (CISA KEV) status, and no vendor patch has been released because Linksys did not respond to the disclosure; practical exploitation requires reachability of the HTTP management interface plus valid (or default/weak) credentials, which on default deployments is typically LAN-side.
Earlier versions of this analysis (1)
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated, low-privileged attackers with access to the router's web management interface to execute arbitrary shell commands via the 6rd tunnel parameters _6rd_prefix and _6rd_prefix_len in the setLinksysIpv6 handler. The flaw carries a CVSS 4.0 score of 9.4 and publicly available exploit code exists; the vendor was contacted but did not respond, so no official patch is available. Successful exploitation requires reaching the /goform/setLinksysIpv6 endpoint with valid credentials, though default or weak router passwords are common and would lower the bar.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted early but did not respond, and the CVE references contain no fixed firmware version, so there is nothing to upgrade to and no Linksys security advisory to follow (only the generic https://www.linksys.com/ site). Until a fix appears, the highest-value compensating control is to prevent untrusted parties from reaching the management interface at all: disable WAN-side/remote administration and UPnP-based port exposure so /goform/setLinksysIpv6 is only reachable from the trusted LAN, and, if the deployment requires total safety, place the router behind a second firewall or isolate its management VLAN - the trade-off is loss of the remote-management convenience the feature provides. Replace default and weak administrator credentials immediately and confirm the PR:L requirement cannot be met with factory defaults, since authenticated (even low-privilege) access is the only prerequisite the attacker needs. There is no confirmed way to remove the handler by configuration, so disabling the IPv6/6rd feature may reduce exposure only if the endpoint stops accepting requests when 6rd is off - this is unverified and should not be relied on alone. For a device that is end-of-life and unpatched, the durable options are to retire/replace it or to flash a maintained third-party firmware build only if one is confirmed to support this exact model, since third-party images may themselves lack vendor hardware support. Finally, monitor router logs and outbound DNS/traffic for signs of post-exploitation (unexpected DNS servers, new admin accounts, unexpected outbound connections), and re-check VulDB entry 416683 and the CISA/NVD record periodically in case the vendor or a third party publishes a fixed firmware release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-78 improper neutralization of special elements used in an OS command, rooted in the 6rd (IPv6 Rapid Deployment) tunnel configuration feature of the Linksys E1700 firmware. The web handler setLinksysIpv6, exposed at /goform/setLinksysIpv6 by the device's embedded HTTP management server, takes the _6rd_prefix and _6rd_prefix_len parameters supplied by the administrator and passes them into a shell invocation - most likely the same routine that programs the 6rd tunnel via the device's WAN/IPv6 configuration - without sanitizing shell metacharacters or validating that the prefix is a well-formed IPv6 prefix. Because the values reach a command interpreter unsanitized, an attacker who can submit a crafted POST request can append arbitrary shell commands, giving code execution in the context of the router's web/CGI process. The CVSS 4.0 vector describes network reachability (AV:N), low attack complexity (AC:L), no attack prerequisites beyond the vulnerable system (AT:N), low privileges required (PR:L, i.e. authenticated), no user interaction (UI:N) and high impact across confidentiality, integrity and availability; the proof-of-concept sub-score (E:P) confirms exploit code is publicly available. The official CPE cpe:2.3:a:linksys:e1700:*:*:*:*:*:*:*: uses a wildcard version, so although only firmware 1.0.0.4.003 was empirically confirmed vulnerable, any E1700 build shipping the same unpatched setLinksysIpv6 handler should be treated as suspect. This is a consumer/SOHO router, so a successful inject yields a persistent foothold suitable for DNS hijacking, traffic interception, or lateral movement into the LAN.
Know when E1700 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable web handler (AV:N/AC:L), requires an authenticated low-privilege session (PR:L), and command injection yields full device compromise (C/I/A:H); impact stays within the device so S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
The supplied evidence is a vendor vulnerability report, not an upstream patch diff, so there is no changed-line diff to read.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Linksys E1700 router running firmware 1.0.0.4.003 contains an authenticated command injection flaw that allows anyone holding low-privilege device credentials to execute arbitrary operating system commands on the router, granting full control over its confidentiality, integrity, and availability. Because Linksys has not responded to the disclosure and no patch exists, any organization with E1700 units in service - particularly branch offices, retail sites, or remote workers relying on these devices as their network edge - faces an unpatchable exposure that publicly available exploit code makes trivial to reproduce. Leadership should treat every internet- or guest-reachable E1700 as a compromised network boundary until the hardware is retired or isolated.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WAN-side remote management and disable the affected HTTP management interface where operationally possible; firewalls should block external access to /goform/setLinksysIpv6; replace default and weak credentials with unique strong passwords and remove unused low-privilege accounts (the flaw requires valid low-privilege credentials); restrict administrative access to a trusted management VLAN or fixed source IPs; segment E1700 devices away from internal systems so a compromised router cannot pivot; monitor logs for anomalous requests to setLinksysIpv6; and accelerate replacement of the E1700 with a vendor-supported device since no patch is forthcoming.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an at
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell c
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbit
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an a
Exploit-DB