E1700
Monthly
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003) lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by manipulating the _6rd_prefix and _6rd_prefix_len parameters handled by setLinksysIpv6 at /goform/setLinksysIpv6. The flaw scores 8.6 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N, E:P) and 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact on the router. Publicly available exploit code exists - including a published proof-of-concept write-up referenced from the CVE record - but there is no confirmed actively exploited (CISA KEV) status, and no vendor patch has been released because Linksys did not respond to the disclosure; practical exploitation requires reachability of the HTTP management interface plus valid (or default/weak) credentials, which on default deployments is typically LAN-side.
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell commands on the device by sending a crafted request to the /goform/setDMZ endpoint with a manipulated MAC_addr parameter. Exploitation requires network reachability to the web management interface (LAN-side by default, or internet-facing if remote administration is enabled) plus at least low-privilege authenticated access, and needs no user interaction; the vendor did not respond to the disclosure, so no patch is available. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which raises the likelihood of opportunistic attacks against exposed devices.
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbitrary OS commands on the device via crafted input to the static route parameters in /goform/addStaticRoute. Publicly available exploit code exists, increasing the risk of exploitation; no vendor patch has been released as Linksys did not respond to the disclosure. The vulnerability requires network access to the management interface and valid credentials, but successful exploitation grants full control of the router.
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an attacker who can reach the router's administrative web interface to send an overlong newap_text_%d value to /goform/ssid1MACFilter and corrupt the stack, resulting in a crash and potentially code execution with the privileges of the device's web server. Publicly available exploit code exists (a detailed PoC is published on GitHub), but there is no CISA KEV listing and active exploitation has not been confirmed, so this should be treated as a credible but not yet observed attack. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been confirmed; the provided CVSS 4.0 vector rates it 9.3 with PR:N, while our independent assessment maps the same flaw to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, because the /goform endpoint sits behind the admin UI and is normally reachable only after authenticating - resolving that pre-auth vs. post-auth question is the single biggest factor in real-world risk.
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003) lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by manipulating the _6rd_prefix and _6rd_prefix_len parameters handled by setLinksysIpv6 at /goform/setLinksysIpv6. The flaw scores 8.6 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N, E:P) and 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact on the router. Publicly available exploit code exists - including a published proof-of-concept write-up referenced from the CVE record - but there is no confirmed actively exploited (CISA KEV) status, and no vendor patch has been released because Linksys did not respond to the disclosure; practical exploitation requires reachability of the HTTP management interface plus valid (or default/weak) credentials, which on default deployments is typically LAN-side.
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell commands on the device by sending a crafted request to the /goform/setDMZ endpoint with a manipulated MAC_addr parameter. Exploitation requires network reachability to the web management interface (LAN-side by default, or internet-facing if remote administration is enabled) plus at least low-privilege authenticated access, and needs no user interaction; the vendor did not respond to the disclosure, so no patch is available. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which raises the likelihood of opportunistic attacks against exposed devices.
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbitrary OS commands on the device via crafted input to the static route parameters in /goform/addStaticRoute. Publicly available exploit code exists, increasing the risk of exploitation; no vendor patch has been released as Linksys did not respond to the disclosure. The vulnerability requires network access to the management interface and valid credentials, but successful exploitation grants full control of the router.
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an attacker who can reach the router's administrative web interface to send an overlong newap_text_%d value to /goform/ssid1MACFilter and corrupt the stack, resulting in a crash and potentially code execution with the privileges of the device's web server. Publicly available exploit code exists (a detailed PoC is published on GitHub), but there is no CISA KEV listing and active exploitation has not been confirmed, so this should be treated as a credible but not yet observed attack. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been confirmed; the provided CVSS 4.0 vector rates it 9.3 with PR:N, while our independent assessment maps the same flaw to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, because the /goform endpoint sits behind the admin UI and is normally reachable only after authenticating - resolving that pre-auth vs. post-auth question is the single biggest factor in real-world risk.