9.9Kritisch
CVE-2026-86299Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
Beschreibung
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Linksys | RE7000 | 2.0.15 | |
| linksys | re7000 firmware | — |
Referenzen und Patches
- VDB-399463 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection vdb-entrytechnical-description
- VDB-399463 | CTI Indicators (IOB, IOC, TTP, IOA) signature
- CVE-2026-86299 | CVE Analysis and Report third-party-advisory
- Submit #906547 | Linksys RE7000 v2 2.0.15 Command Injection third-party-advisory
- https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md exploit
- https://www.linksys.com/ product