CVE-2026-108895: OS Command Injection in Linksys E1700

This vulnerability affects Linksys E1700 firmware version 1.0.0.4.003. The setDMZ function in the /goform/setDMZ file improperly handles the MAC_addr argument, enabling an attacker to perform OS command injection remotely. The vulnerability allows execution of arbitrary commands on the device with low attack complexity and no privileges required. The exploit has been publicly disclosed, but the vendor has not issued any fix or advisory. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction needed, and high impact on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability is critical due to its remote exploitability, lack of required privileges, and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As of the latest information, the vendor has not responded or released a fix. Until a patch is available, affected devices should be isolated from untrusted networks or replaced. Network-level protections such as firewall rules blocking access to the /goform/setDMZ endpoint may mitigate exposure.