Linksys E1700 IPv6 Config Bug Enables Remote OS Command Injection in Unpatched Firmware
Researchers found a severe code injection bug in Linksys E1700 firmware version 1.0.0.4.003. The vendor did not respond to early outreach about the issue.
Key points
- CVE-2026-108896 allows remote OS command injection via IPv6 configuration fields.
- The flaw affects Linksys E1700 routers running firmware version 1.0.0.4.003.
- Public exploit code exists and the vendor has not issued a patch or response.
Security researchers have identified a critical remote code execution vulnerability in Linksys E1700 router firmware. The flaw, tracked as CVE-2026-108896, allows attackers to inject operating system commands through manipulated IPv6 arguments. The National Vulnerability Database lists the CVSS score as 9.4, indicating a critical severity level for this specific finding.
The vulnerability resides in the setLinksysIpv6 function within the /goform/setLinksysIpv6 file. Attackers can exploit this by manipulating the _6rd_prefix and _6rd_prefix_len arguments. This manipulation results in OS command injection, as classified under CWE-78 and CWE-77. The attack can be launched remotely, making any exposed device a potential target for unauthorized control.
Context and background
The NVD record indicates that the exploit for this vulnerability has been made public. This means the code required to take advantage of the flaw is available for use by malicious actors. The disclosure process began with early contact to the vendor regarding the issue. However, the material states that the vendor did not respond in any way to these initial communications.
Another NVD record lists the same CVE-2026-108896 with a slightly lower CVSS score of 8.6, categorizing it as high severity. Both records describe the same technical root cause: command injection via IPv6 argument manipulation in the specified firmware version. The discrepancy in scoring likely reflects different environmental assumptions, but both ratings confirm the serious nature of the remote execution risk.
Who is affected
The vulnerability specifically affects Linksys E1700 devices running firmware version 1.0.0.4.003. Users of this specific software release are directly exposed to the command injection risk. The source material does not confirm whether other Linksys models or different firmware versions are affected. Security teams should verify their firmware versions against this specific identifier to determine exposure.
Our take on the response
The lack of vendor response to early disclosure is concerning for users relying on this hardware. With public exploit code available and no confirmed patch, users of version 1.0.0.4.003 face an elevated risk of remote compromise. That suggests organizations must treat this as an active threat rather than a theoretical flaw. Immediate defensive actions are necessary to mitigate the risk of unauthorized remote command execution on these routers.
Background: CVSS score
The Common Vulnerability Scoring System (CVSS) assigns a numerical score from 0.0 to 10.0 to software vulnerabilities. It calculates this number by weighing factors like attack complexity, required privileges, and impact on confidentiality, integrity, and availability. You use the score to compare the severity of different flaws, but you must adjust for your own context to prioritize fixes correctly.
Read the full guide: How CVSS Scores Work: The Math Behind Vulnerability Ratings
What to do and how to stay safe: Linksys
- Check firmware versions on all Linksys E1700 routers to identify if they are running 1.0.0.4.003.
- Restrict remote access to the router management interface to trusted IP addresses only.
- Monitor network traffic for unusual outbound connections or unexpected command execution patterns.
- Consider replacing affected devices with models that receive regular security updates.
Step-by-step guide: Vulnerability Prioritization for Small Businesses
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108896?
It is a critical OS command injection vulnerability in Linksys E1700 firmware version 1.0.0.4.003 that allows remote code execution.
Is there a patch available for this flaw?
No fix has been confirmed yet. The source material states the vendor did not respond to early contact about the disclosure.
Which devices are affected by this vulnerability?
Only Linksys E1700 routers running firmware version 1.0.0.4.003 are explicitly listed as affected in the NVD records.
