CVE-2026-108894: OS Command Injection in Linksys E1700

This vulnerability exists in the addStaticRoute function of the /goform/addStaticRoute endpoint in Linksys E1700 firmware version 1.0.0.4.003. By manipulating the arguments staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting, an attacker can perform OS command injection remotely without user interaction. The flaw allows execution of arbitrary commands on the device's operating system, potentially leading to full compromise. The vendor was contacted but did not respond, and no official patch or fix has been published. Public exploit code is available, increasing the likelihood of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full control over the router. This can result in unauthorized access, network manipulation, or further attacks on connected systems. The vulnerability is remotely exploitable without user interaction and has a critical severity rating.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider mitigating exposure by restricting access to the affected device's management interface from untrusted networks. Monitor for any vendor advisories for updates. Due to public exploit availability, urgent caution is advised.