CVE-2026-86299Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection

Description

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• VDB-399463 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection vdb-entrytechnical-description
• VDB-399463 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-86299 | CVE Analysis and Report third-party-advisory
• Submit #906547 | Linksys RE7000 v2 2.0.15 Command Injection third-party-advisory
• https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md exploit
• https://www.linksys.com/ product