CVE-2026-121933Critical· 10.0▾ MidnightA flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authen…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1.0%
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
E5350 1.0.00.037Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121932Critical· 10.0Linksys E5350 apply.cgi system os command injection
CVE-2026-121615Critical· 10.0Linksys E5600 Login mesh_login.cgi improper authentication
CVE-2026-121931Critical· 9.1Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection
CVE-2026-121930Critical· 9.1Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection
CVE-2026-121618Medium· 5.3Linksys E5600 Factory Quality Control fqc.cgi information disclosure
CVE-2026-121617High· 7.5Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write