Description

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-07T12:17:21.340Z",
  "pubdate": "2026-09-07T12:17:21.340Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Linksys RE7000 range extender, specifically within the PingTest Handler component of the firmware version 2.0.15.\nThe vulnerability originates from improper neutralization of user-supplied input provided to the pingTestIp, pingTestPktSize, and pingTestTimes arguments processed by the platform_event_pingTest function via the /cgi-bin/json.cgi?PingTest endpoint.\nSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary system commands with the privileges of the web service, which typically runs with root or high-level administrative permissions.\nThis vulnerability poses a severe risk to confidentiality, integrity, and availability, as it enables full system compromise, persistent backdoor installation, or lateral movement within the local network.\nGiven that the exploit is publicly available, the risk of exploitation by malicious actors is high. Users are exposed regardless of physical proximity if the management interface is accessible via the network.",
  "technicalDetails": "The vulnerability resides within the platform_event_pingTest function located in the PingTest Handler component of the Linksys RE7000, version 2.0.15. The system fails to implement sufficient input validation or sanitization mechanisms for parameters accepted via the /cgi-bin/json.cgi?PingTest URI, specifically the pingTestIp, pingTestPktSize, and pingTestTimes arguments.\nThe root cause is a classic OS command injection flaw where user-supplied input is directly concatenated or insufficiently sanitized before being passed to a system-level command execution API (such as system(), popen(), or equivalent wrappers used in the device's CGI binaries). By injecting shell metacharacters (e.g., ;, &&, ||, or backticks), an attacker can terminate the intended ping command and append arbitrary malicious commands.\nThe attack flow proceeds as follows: 1) The attacker initiates a crafted HTTP request to the /cgi-bin/json.cgi?PingTest endpoint. 2) The attacker embeds shell injection sequences within the aforementioned vulnerable arguments. 3) The web server processes the request and invokes platform_event_pingTest, which inadvertently executes the attacker's payload within the underlying Linux-based operating system of the RE7000.\nBecause the vulnerability is reachable remotely without requiring prior authentication, it allows an external entity to interact with the device's management interface to execute arbitrary code. The impact is catastrophic, as the device operates at a system level, allowing the attacker to bypass authentication, extract sensitive configuration files, modify network traffic, or pivot into other devices connected to the local area network.\nPayload behavior typically involves the execution of shell commands such as 'wget' or 'curl' to download secondary malware stages, the spawning of reverse shells, or the modification of system binaries to ensure persistence across reboots. Since the PingTest Handler is a core system component, the resulting process runs with elevated system privileges, rendering traditional user-space restrictions ineffective. The exposure is network-wide, provided the target device's administration interface is reachable from the attacker's segment."
}