CVE-2026-86299: OS Command Injection in Linksys RE7000

CVE-2026-86299 is a remote OS command injection vulnerability in the Linksys RE7000 firmware version 2.0.15. The flaw exists in the platform_event_pingTest function within the PingTest Handler component, accessible via the /cgi-bin/json.cgi?PingTest CGI endpoint. By manipulating the arguments pingTestIp, pingTestPktSize, or pingTestTimes, an attacker with network access can inject arbitrary OS commands. This vulnerability has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity and results in complete compromise of confidentiality, integrity, and availability of the device. Public exploit code is available, increasing the risk of exploitation. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated beyond version 2.0.15 being vulnerable.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, leading to full compromise of confidentiality, integrity, and availability. This can result in unauthorized control over the device, data leakage, disruption of network services, or further lateral attacks within the network. The vulnerability is remotely exploitable with low attack complexity and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable device, especially to the /cgi-bin/json.cgi?PingTest endpoint, to trusted users only. Monitor for unusual activity related to ping test functions and consider network-level controls to block exploitation attempts. Avoid exposing the device management interface to untrusted networks.