9.9Crítica
CVE-2026-86299Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
Descripción
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Linksys | RE7000 | 2.0.15 | |
| linksys | re7000 firmware | — |
Referencias y parches
- VDB-399463 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection vdb-entrytechnical-description
- VDB-399463 | CTI Indicators (IOB, IOC, TTP, IOA) signature
- CVE-2026-86299 | CVE Analysis and Report third-party-advisory
- Submit #906547 | Linksys RE7000 v2 2.0.15 Command Injection third-party-advisory
- https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md exploit
- https://www.linksys.com/ product