CVE-2026-121930
CriticalCVSS 9.1Summary
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
A remote attacker can execute arbitrary commands on the router, taking control of the device; the product is no longer supported by the maintainer.
Recommendation
Since the device is unsupported, replace it or isolate it from the network and disable remote access to the diagnostic interface.
Other vulnerabilities in Linksys WRT54GL
See all- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2023-31742High
A command injection vulnerability exists in the Linksys WRT54GL router with firmware version 4.30.18.006. An attacker with web management privileges can inject commands into POST request parameters in the httpd's Start_EPI() function, gaining shell access.
Original NVD description (English source)
A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS