CVE-2026-108896: OS Command Injection in Linksys E1700

This vulnerability affects Linksys E1700 firmware version 1.0.0.4.003. The setLinksysIpv6 function improperly sanitizes input parameters _6rd_prefix and _6rd_prefix_len, leading to OS command injection. An attacker can remotely send crafted requests to the /goform/setLinksysIpv6 endpoint to execute arbitrary operating system commands with elevated privileges. The exploit has been publicly disclosed, and the vendor has not issued any fix or advisory.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full device compromise, unauthorized control, and disruption of network operations. Given the critical CVSS score of 9.4 and the availability of public exploit code, this vulnerability poses a severe risk to affected devices.

No official fix or patch is currently available from the vendor. Users should consider discontinuing use of the affected firmware version 1.0.0.4.003 or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for any future advisories or patches. Until a fix is released, avoid exposing the device management interface to untrusted networks.