CVE-2026-108895: Linksys E1700 setDMZ OS Command Injection

Overview

The record describes a command injection weakness in the setDMZ function, reachable at /goform/setDMZ on the Linksys E1700 version 1.0.0.4.003. The weakness is classified as CWE-77 (Command Injection). According to the description, manipulating the MAC_addr argument can lead to execution of operating system commands.

Impact

• The CVSS 3.1 vector in the record is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which describes a network-reachable flaw with low attack complexity, a requirement for low privileges, no user interaction, a scope change and high impact on confidentiality, integrity and availability.
• The base score of 9.9 is attributed to the CNA VulDB. Other scores listed in the record come from different CVSS versions and providers and differ from this value.
• Because the vector includes a scope change, a successful attack could affect components beyond the vulnerable function. The exact boundaries are not described in the record.

Affected products and versions

• Product listed: Linksys E1700, version 1.0.0.4.003.
• The record does not list any other affected versions, and it does not list a fixed version. Whether earlier or later releases are affected is unknown.

Exploitation status

• The record states that an exploit has been made publicly available and could be used in attacks. A repository reference tagged as an exploit is included in the record.
• The record shows that the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted.
• The SSVC data in the record marks exploitation as proof of concept and automatable as no. The EPSS probability is about 2.2 percent, with a date of 2026-10-13.

Remediation and mitigation

• No vendor fix is listed in the record, and the vendor did not respond to the disclosure. Organizations should check the Linksys website for firmware or support notices and treat the absence of a fix as unknown, not as the absence of one.
• Restrict access to the device web management interface to trusted administrative networks, and disable remote administration where it is not needed.
• Consider replacing or isolating affected devices that cannot be protected, especially where they face untrusted networks.
• Monitor the VulDB entry and the CVE record for updates.

Detection guidance

• Review device and network logs for unusual requests to the setDMZ endpoint, particularly requests with unexpected content in the MAC address parameter.
• Look for unexpected outbound connections or configuration changes originating from the router.
• Inventory devices running the affected version so that monitoring can be prioritized.

Limitations of the available information

• The record does not describe the exact conditions needed for exploitation beyond the vector, nor whether authentication is enforced in every configuration.
• No vendor advisory, patch, or fixed version is available in the record.
• The list of affected versions contains only one entry, so the full scope is unknown.
• The description is based on third-party analysis by VulDB; the vendor has not confirmed it.

Frequently asked questions

Is this Linksys E1700 vulnerability known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit is available, so the risk of future exploitation should be treated seriously.

Is there a fixed version for this issue?

No fixed version is listed in the record, and the vendor did not respond to the disclosure. The absence of a listed fix is unknown information, not proof that no fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.