Description

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T15:17:07.423Z",
  "pubdate": "2026-10-12T15:17:07.423Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Linksys E1700 router, specifically within the firmware version 1.0.0.4.003.\nThe vulnerability resides in the /goform/setLinksysIpv6 handler, where improper input sanitization of the _6rd_prefix and _6rd_prefix_len arguments allows for the remote execution of arbitrary system commands.\nThe impact of this flaw is severe, potentially allowing an unauthenticated remote attacker to gain full control over the affected device.\nThe risk is exacerbated by the lack of vendor response and the public availability of exploit code, which lowers the barrier to entry for potential attackers.\nThis vulnerability stems from the direct integration of user-supplied data into system-level operations without validation or escaping, representing a failure in secure input handling practices within the web interface.",
  "technicalDetails": "The vulnerability is localized within the web-based management interface of the Linksys E1700, specifically targeting the /goform/setLinksysIpv6 function. This function is designed to handle IPv6 6rd configuration settings provided via HTTP POST requests.\nThe root cause of the vulnerability is the unsafe processing of the _6rd_prefix and _6rd_prefix_len parameters. The application logic fails to perform adequate input validation or sanitization before passing these variables to system-level calls. Consequently, an attacker can supply specially crafted payloads containing shell metacharacters (such as backticks, semicolons, or pipe symbols) within these fields.\nThe exploitation flow begins with a remote attacker sending a crafted HTTP POST request to the /goform/setLinksysIpv6 endpoint. By injecting malicious command sequences into the _6rd_prefix or _6rd_prefix_len arguments, the attacker can force the underlying operating system to execute arbitrary commands with the privileges of the web server process.\nGiven that the target is a network appliance, the web service typically runs with elevated privileges, often as the root user. This grants the attacker full administrative control over the router's operating system upon successful exploitation.\nThe payload behavior involves triggering the system shell via an 'exec' or 'system' call within the binary that processes the form input. Since the application does not utilize secure API alternatives or parameterize inputs to separate code from data, the shell interprets the injected metacharacters as instructions to execute subsequent commands.\nPost-exploitation impact includes persistent compromise of the device, enabling the attacker to reconfigure network traffic, perform man-in-the-middle attacks, exfiltrate sensitive configuration data, or incorporate the device into a botnet. The exposure is categorized as remote, meaning no local access is required to facilitate the attack vector. As the exploit is publicly documented, it poses an immediate threat to any Linksys E1700 unit running firmware version 1.0.0.4.003 that is accessible via the network."
}