Description

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T15:17:07.227Z",
  "pubdate": "2026-10-12T15:17:07.227Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in Linksys E1700 version 1.0.0.4.003, specifically within the /goform/setDMZ endpoint. The vulnerability arises from improper sanitization of the MAC_addr argument, allowing an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges.\nThe flaw stems from the application passing unsanitized user input directly to a system shell execution function. Successful exploitation allows for complete system compromise, including unauthorized access to network configurations, credential theft, or the establishment of persistent backdoors.\nGiven that the vulnerability is remotely exploitable and public exploit code is available, the risk to the confidentiality, integrity, and availability of the affected device is critical. The vendor has not provided a patch for this disclosure, leaving deployed units exposed to potential exploitation by threat actors.",
  "technicalDetails": "The vulnerability resides in the /goform/setDMZ file, which processes DMZ configuration settings. The specific target function, setDMZ, fails to implement sufficient input validation or command escaping when processing the 'MAC_addr' parameter.\nThe root cause is a failure in the application's sanitization layer, which allows shell metacharacters (such as ';', '&', or '|') to be injected into the MAC_addr argument string. When the device backend processes this request, the input is concatenated into a system-level command string before being passed to a function such as 'system()' or 'popen()'.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious HTTP POST request targeting the /goform/setDMZ URI. 2) The attacker injects the desired payload into the 'MAC_addr' field, incorporating shell-specific command chaining operators to terminate the intended system command and initiate a secondary command execution. 3) The router's firmware receives the request and, due to the lack of input validation, interprets the injected shell sequence as part of the intended administrative command. 4) The underlying OS executes the attacker's payload with the privileges of the web server process (typically root or high-privilege service accounts).\nBecause the interface is reachable over the network, this vulnerability does not require physical access to the device. Exploitation results in immediate command execution, granting the attacker control over the underlying Linux-based operating system. This allows for the manipulation of system binaries, exfiltration of sensitive configuration files (including WPA/WPA2 keys), or redirection of network traffic. Given the lack of input filtering, there is no requirement for sophisticated bypass techniques, as the input is directly interpreted by the shell environment. Post-exploitation, an attacker could potentially modify firewall rules to permanently open access to the internal network or deploy malicious firmware updates, resulting in persistent and difficult-to-detect unauthorized access."
}