CVE-2026-121931
CriticalCVSS 9.1Summary
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can execute arbitrary commands on the router, taking control of the device; the product is no longer supported by the maintainer.
Recommendation
Since the device is unsupported, replace it or isolate it from the network and disable remote access to the diagnostic interface.
Other vulnerabilities in Linksys WRT54GL
See all- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2023-31742High
A command injection vulnerability exists in the Linksys WRT54GL router with firmware version 4.30.18.006. An attacker with web management privileges can inject commands into POST request parameters in the httpd's Start_EPI() function, gaining shell access.
Original NVD description (English source)
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS