Linksys vulnerabilities
228 vulnerabilities
Known vulnerabilities in Linksys products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 110 products.
Products
50 of 110- Re650061 vulnerabilities
- Re700060 vulnerabilities
- Re630058 vulnerabilities
- Re625057 vulnerabilities
- Re635057 vulnerabilities
- Re900057 vulnerabilities
- E560018 vulnerabilities
- Wrt54G13 vulnerabilities
- E845012 vulnerabilities
- E120011 vulnerabilities
- E170011 vulnerabilities
- Mr96009 vulnerabilities
- E73508 vulnerabilities
- Wrt54Gl8 vulnerabilities
- Befsr416 vulnerabilities
- Ea65006 vulnerabilities
- Mx42006 vulnerabilities
- E25005 vulnerabilities
- Befvp414 vulnerabilities
- E20004 vulnerabilities
- Wag54Gs4 vulnerabilities
- Befn2Ps43 vulnerabilities
- Befsr113 vulnerabilities
- Befsru313 vulnerabilities
- Befsx413 vulnerabilities
- Befw11S43 vulnerabilities
- Ea45003 vulnerabilities
- Eseries E12003 vulnerabilities
- Eseries E25003 vulnerabilities
- Wap113 vulnerabilities
- Wrt1900Acs3 vulnerabilities
- Wrt54Gl Wireless G Broadband Router3 vulnerabilities
- Wrt54Gs3 vulnerabilities
- Befsr812 vulnerabilities
- E10002 vulnerabilities
- E15002 vulnerabilities
- E30002 vulnerabilities
- E32002 vulnerabilities
- E4200V22 vulnerabilities
- Ea27002 vulnerabilities
- Ea35002 vulnerabilities
- Ea62002 vulnerabilities
- Ea63002 vulnerabilities
- Ea64002 vulnerabilities
- Ea67002 vulnerabilities
- Ea69002 vulnerabilities
- Ea75002 vulnerabilities
- Fgw3000 Ah2 vulnerabilities
- Fgw3000 Hk2 vulnerabilities
- Wap400N2 vulnerabilities
CVE-2026-114576linksysre6250
EPSS score0.41%
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.CVE-2026-108896linksyse1700EPSS score2.20%
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-108895linksyse1700EPSS score2.20%
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-108894linksyse1700EPSS score2.16%
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-108892linksyse1700EPSS score0.62%
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-108893linksyse1700EPSS score0.53%
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2018-17208linksysvelop_firmwareEPSS score2.53%
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF.CVE-2018-3953linksyse1200_firmware+3EPSS score13.51%
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.CVE-2018-3954linksyse1200_firmware+3EPSS score3.38%
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.CVE-2018-3955linksyse1200_firmware+3EPSS score4.82%
An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this vulnerability. Data entered into the 'Domain Name' input field through the web portal is submitted to apply.cgi as the value to the 'wan_domain' POST parameter. The wan_domain data goes through the nvram_set process described above. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.CVE-2003-1497linksysbefsx41EPSS score1.40%
Buffer overflow in the system log viewer of Linksys BEFSX41 1.44.3 allows remote attackers to cause a denial of service via an HTTP request with a long Log_Page_Num variable.CVE-2013-4658linksysea6500_firmwareEPSS score9.34%
Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.CVE-2013-10062linksyse1500_firmwareEPSS score2.07%
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.CVE-2013-10058linksyswrt160nv2EPSS score4.32%
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.CVE-2013-3067linksyswrt310n_firmwareEPSS score0.76%
Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.CVE-2013-3065linksysea6500_firmwareEPSS score0.78%
Cross-site scripting (XSS) vulnerability in the Parental Controls section in Linksys EA6500 with firmware 1.1.28.147876 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Blocked Specific Sites section.CVE-2013-3064linksysea6500_firmwareEPSS score1.26%
Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.147876 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the target parameter.CVE-2013-3066linksysea6500_firmwareEPSS score2.06%
Linksys EA6500 with firmware 1.1.28.147876 does not properly restrict access, which allows remote attackers to obtain sensitive information (clients and router configuration) via a request to /JNAP/.CVE-2013-3307linksyse1000_firmware+2EPSS score63.11%
Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.CVE-2007-1585linksyswag200g+1EPSS score1.32%
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.