EUVD-2026-97468
GHSA-v6gp-cmwg-49h5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitPOST to /goform/setDMZ with malicious MAC_addr
-
ExecutionInjected shell command executes as router OS
-
ImpactFull device compromise and traffic control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Linksys E1700 web management interface and at least low-privilege authenticated access (CVSS PR:L), after which a crafted request to /goform/setDMZ with a manipulated MAC_addr argument triggers the injection. The practical limiting factors are: (1) valid low-privilege credentials to the router admin panel, and (2) network path to the management interface - typically LAN-side by default, so internet-facing exploitation requires remote administration to be enabled. No user interaction is needed. Affected firmware is specifically version 1.0.0.4.003. |
| Impact | Signals are moderately aligned toward a real but bounded threat. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, all impacts High) rates this 8.6 HIGH, and the CWE-78 OS command injection in setDMZ plausibly yields full device takeover. A public exploit exists (VulDB/GitHub PoC) and the 4.0 vector carries E:P (Proof-of-Concept), consistent with that PoC. However, this is NOT CISA KEV-listed and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the public PoC raises opportunistic risk but does not confirm in-the-wild use. Critically, PR:L means exploitation requires at least low-privilege authenticated access to the router's web interface, which meaningfully lowers real-world risk versus a fully unauthenticated flaw; AV:N is technically network but a SOHO router management interface is normally LAN-bound, so true internet-facing exposure depends on whether remote administration is enabled. The vendor did not respond to disclosure, meaning no patch is expected - a persistent, unmitigated condition. Net: a genuine high-severity bug worth prioritizing for anyone running this specific device, but tempered by the authentication prerequisite and the niche, likely end-of-life product footprint rather than a mass-exploitation emergency. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the E1700 web management interface (via LAN, or over the internet if remote administration is exposed) sends a crafted request to /goform/setDMZ with a malicious MAC_addr value. Because the value is passed unsanitized into an OS command, the attacker injects shell commands that execute with the router's OS privileges, yielding full device compromise. A public proof-of-concept is available on GitHub, lowering the skill needed to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 12, 2026
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell commands on the device by sending a crafted request to the /goform/setDMZ endpoint with a manipulated MAC_addr parameter. Exploitation requires network reachability to the web management interface (LAN-side by default, or internet-facing if remote administration is enabled) plus at least low-privilege authenticated access, and needs no user interaction; the vendor did not respond to the disclosure, so no patch is available. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which raises the likelihood of opportunistic attacks against exposed devices.
Earlier versions of this analysis (1)
OS command injection in Linksys E1700 firmware 1.0.0.4.003 lets an authenticated low-privilege user of the web management interface run arbitrary OS commands on the router by sending a crafted MAC_addr value to the /goform/setDMZ endpoint, and publicly available exploit code exists. Although the CVSS 4.0 base score is 9.4, exploitation requires a valid web-interface session (PR:L) and reachability to the admin panel-typically LAN adjacency or explicitly enabled remote administration-so real-world risk depends heavily on exposure and credential hygiene. No vendor patch has been released and the vendor did not respond to the disclosure.
RemediationAI
No vendor-released patch has been identified at the time of analysis: the vendor was contacted about the disclosure and did not respond, and none of the available references point to a fixed firmware build, so there is no confirmed remediated version for the E1700. Until a fix appears, apply compensating controls that remove the exposure path. First and most effective: disable remote/web administration from the WAN side and keep the admin interface reachable only from the trusted LAN, which directly blocks internet-facing exploitation but does not stop a malicious or compromised LAN client. Second, if the E1700 is still used, replace default and weak administrator credentials with unique strong passwords and avoid shared or reused credentials, since the flaw requires low-privilege authenticated access (PR:L) and credential reuse materially lowers the bar. Third, segment IoT/guest traffic away from the management VLAN and place the router behind a firewall that restricts inbound access to TCP 80/443; the trade-off is added network complexity and blocked legitimate remote management. Fourth, monitor router and upstream logs for anomalous POST requests to /goform/setDMZ or unexpected outbound connections from the device as a detection measure, understanding this is detective only and not a substitute for patching. Given the public proof-of-concept and the absence of vendor fixes, the most durable option is to retire or replace the E1700 with a vendor-supported router that receives security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic OS command injection (CWE-78) in the setDMZ handler of the Linksys E1700's embedded web management service, reached via the /goform/setDMZ URI. The MAC_addr argument is passed into a shell-level operation without adequate neutralization of shell metacharacters, allowing an authenticated caller to append or substitute commands that are then executed with the privileges of the router's web daemon (typically root on consumer firmware). The CPE record cpe:2.3:a:linksys:e1700:*:*:*:*:*:*:*:* confirms the affected product line is the E1700 appliance family, with the disclosed firmware build being 1.0.0.4.003; because the CPE uses a wildcard version, other builds should be assumed potentially affected until the vendor clarifies. Independent assessment using CVSS 3.1 yields AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (high confidentiality, integrity and availability impact), consistent with the vendor-reported CVSS 4.0 score of 8.6; both vectors agree the attack is remotely reachable but requires low-privilege authentication (PR:L), so the realistic attack surface is the router's admin interface rather than an unauthenticated network service.
Know when E1700 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Authenticated low-privilege web access is required (PR:L), no user interaction (UI:N), and command injection as the router OS gives full C/I/A impact on the single device (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-78 OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Linksys E1700 router running firmware 1.0.0.4.003 is affected by a high-severity command injection flaw that allows an attacker with access to the web management interface to execute shell commands on the device. Publicly available exploit code exists and no vendor-released patch identified at time of analysis, so exposure is greatest where remote administration is enabled or the management interface is reachable from untrusted networks. Leadership should prioritize locating and isolating these devices because they can be used to disrupt connectivity, intercept traffic, or pivot into the broader network.
No vendor-released patch identified at time of analysis; interim mitigations include disabling remote administration, restricting management interface to trusted LAN/VPN, segmenting affected devices, monitoring for exploitation, and replacing end-of-life hardware.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an at
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbit
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an a
Exploit-DB