Key points
- CVE-2026-108894 affects Linksys E1700 firmware version 1.0.0.4.003 with a CVSS score of 9.4.
- The flaw enables remote OS command injection through the static route handler component.
- Public exploit code is available, and the vendor has not responded to initial contact.
A critical security vulnerability has been identified in the Linksys E1700 router, specifically affecting firmware version 1.0.0.4.003. This flaw, tracked as CVE-2026-108894, allows remote attackers to inject operating system commands, potentially leading to full device compromise.
The vulnerability resides in the `addStaticRoute` function within the `/goform/addStaticRoute` file, part of the Static Route Handler component. According to the National Vulnerability Database (NVD) record, manipulating specific arguments such as `staticRoute_IP_setting`, `staticRoute_Netmask_setting`, `staticRoute_Gateway_setting`, or `staticRoute_Metric_setting` triggers the OS command injection. The NVD rates the severity as Critical with a CVSS score of 9.4.
Technical details of the flaw
The underlying weaknesses are classified as CWE-78 and CWE-77, which relate to OS command injection vulnerabilities. The NVD description notes that remote exploitation is possible, meaning an attacker does not need physical access to the device. Furthermore, the record explicitly states that exploit code has been released to the public, increasing the likelihood of malicious use.
A second NVD record for the same CVE ID lists the severity as High with a CVSS score of 8.6, citing the same CWE classifications and technical details. This discrepancy in scoring does not change the fundamental nature of the flaw, which remains a severe remote execution risk.
Vendor response and status
The source material indicates that the vendor was contacted early regarding this disclosure. However, there has been no response from Linksys in any form. Consequently, no patch, fix, or security update has been confirmed for the affected firmware version 1.0.0.4.003. Users remain exposed until a vendor response is received.
Our take on the response
The absence of a vendor response combined with the availability of public exploit code creates a high-risk scenario for users of this specific firmware version. Without an official patch, organisations must rely on compensating controls to mitigate the risk of remote exploitation.
Background: Command injection
Look for unexpected process spawns, anomalous outbound connections, and slight delays in application responses. Check logs for shell metacharacters like semicolons or pipes. Validate all inputs strictly and isolate execution environments immediately.
Read the full guide: Command Injection Warning Signs: Detect Silent Backdoors
What to do and how to stay safe: Linksys
- Verify if your Linksys E1700 router is running firmware version 1.0.0.4.003 by checking the device's administrative interface.
- Isolate the affected device from the internet or place it on a segregated network segment to prevent remote exploitation attempts.
- Monitor network logs for unusual outbound traffic or signs of command execution originating from the router.
- Contact the vendor directly to inquire about the status of a security patch for CVE-2026-108894.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108894?
It is a critical security flaw in Linksys E1700 firmware 1.0.0.4.003 that allows remote OS command injection via the static route handler.
Is there a patch available?
No, the vendor has not responded to contact, and no fix has been confirmed in the source material.
What are the potential consequences?
Remote exploitation is possible, and public exploit code is available, which may lead to full device compromise.