Linksys has 16 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 8.8 (high), with 7 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-119 (5) and CWE-121 (5). Most affected products: E1700 (5), WAG200G (3), re6500_firmware (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 10 prev 0
Products
- E1700 5
- WAG200G 3
- re6500_firmware 3
- e1200_firmware 2
- RE6250 1
- RE7000 1
Worst active — by depth score
CVE-2026-108896Critical· 9.9A vulnerability was found in Linksys E1700 1.0.0.4.00367CVE-2026-108895Critical· 9.9A weakness has been identified in Linksys E1700 1.0.0.4.00367CVE-2026-108894Critical· 9.9A security flaw has been discovered in Linksys E1700 1.0.0.4.00367CVE-2026-108893Critical· 9.9A vulnerability was identified in Linksys E1700 up to 1.0.0.4.00367CVE-2026-108892Critical· 10.0A vulnerability was determined in Linksys E1700 1.0.0.4.00367
Linksys vulnerabilities
CVEs affecting Linksys, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2013-20008Medium· 6.8Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser …
CVE-2013-20007High· 7.2Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted …
CVE-2013-20009Medium· 4.8Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the Ac…
CVE-2026-114576Low· 3.7PoCLinksys RE6250 Web Management strcmp random values
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be…
CVE-2026-108896Critical· 9.9PoCA vulnerability was found in Linksys E1700 1.0.0.4.003
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack…
CVE-2026-108895Critical· 9.9PoCA weakness has been identified in Linksys E1700 1.0.0.4.003
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be ex…
CVE-2026-108894Critical· 9.9PoCA security flaw has been discovered in Linksys E1700 1.0.0.4.003
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_…
CVE-2026-108893Critical· 9.9PoCA vulnerability was identified in Linksys E1700 up to 1.0.0.4.003
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be la…
CVE-2026-108892Critical· 10.0PoCA vulnerability was determined in Linksys E1700 1.0.0.4.003
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes st…
CVE-2026-86299Critical· 9.9PoCA vulnerability was detected in Linksys RE7000 2.0.15
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSiz…
CVE-2025-52692High· 8.8Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.
Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.
CVE-2025-14136High· 8.8A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001
A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setCl…
CVE-2025-14135High· 8.8A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001
A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so…
CVE-2025-14133High· 8.8A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of t…
CVE-2025-60689Medium· 5.4PoCAn unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz)
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The vulnerability occurs because user-supplied CGI parameters (wl…
CVE-2022-38555Critical· 9.8Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.