A vulnerability was found in Linksys E1700 1.0.0.4.003. (CVE-2026-108896)

CVE-2026-108896 is a remote OS command injection vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. The flaw exists in the /goform/setLinksysIpv6 endpoint, specifically in the setLinksysIpv6 function, where unsanitized input parameters _6rd_prefix and _6rd_prefix_len can be manipulated to inject operating system commands. This vulnerability allows an attacker with network access to execute arbitrary commands with the privileges of the affected service. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity. Although an exploit is publicly available, the vendor has not issued any advisory or patch.

Successful exploitation can lead to full compromise of the affected device, including complete control over the operating system, resulting in confidentiality, integrity, and availability impacts. The vulnerability is remotely exploitable without user interaction and requires low privileges to initiate. Given the critical CVSS score and public exploit availability, this poses a severe risk to affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is publicly documented, users should consider disabling remote access to the vulnerable function or isolating the device from untrusted networks until a fix is available.