Description

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T14:17:09.897Z",
  "pubdate": "2026-10-12T14:17:09.897Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Linksys E1700 (version 1.0.0.4.003). The flaw resides within the /goform/addStaticRoute file, specifically impacting the addStaticRoute function. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary system commands by injecting malicious payloads into the static route configuration parameters. Because the web interface fails to sanitize user-supplied input before passing it to the underlying operating system shell, the device is susceptible to full system compromise. The risk is significantly elevated as a public exploit is available, and the vendor has not provided a security update to address this flaw. Successful exploitation results in complete loss of device control, potentially facilitating lateral movement within the network or participation in botnets.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located in the Static Route Handler component of the Linksys E1700 router. The root cause is the improper handling of user-supplied input within the /goform/addStaticRoute administrative function. Specifically, the application logic fails to perform adequate validation or sanitization on the following arguments: staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, and staticRoute_Metric_setting.\nThe exploitation process involves sending a crafted HTTP POST request to the /goform/addStaticRoute endpoint. An attacker can append shell metacharacters—such as semicolons (;), pipes (|), or backticks (`)—to any of the aforementioned parameters. When the backend logic processes these fields, the system executes the concatenated string as part of a shell command directly on the device's underlying Linux operating system. Because the web process often runs with elevated privileges, the injected code is executed with equivalent permissions.\nThe attack flow proceeds as follows: First, the attacker identifies the target device's administration interface. Second, they craft a malicious request where the input parameters contain a payload designed to execute arbitrary shell commands. Third, the request is transmitted to the server. The application passes these parameters to a system-level function (likely exec() or system() in C or a similar wrapper) without isolating user input from the command execution stream. Finally, the operating system interprets the injected metacharacters, executing the attacker's payload.\nPost-exploitation impact is severe. Since the device acts as a network gateway, successful command injection allows the attacker to achieve persistence, exfiltrate sensitive configuration data, disable security logging, or reconfigure the device to intercept local network traffic (Man-in-the-Middle attacks). Given the absence of vendor-supplied patches, the device remains persistently vulnerable to remote adversaries utilizing the publicly available exploit code. The vulnerability is network-exposed, meaning the management interface does not necessarily require local network access depending on the device's WAN configuration, further increasing the attack surface."
}