Linksys vulnerabilities
We track 115 vulnerabilities in Linksys products across 58 products. 115 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Linksys vulnerabilities
- 8.8 High severity
E8450: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language le
- 10.0 Critical severity
E4200: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter witho
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MA
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been classified as critical. This affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkC
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this issue is the function RP_checkFWByBBS of the file /goform/RP_checkFWByBB
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this vulnerability is the function RP_UpgradeFWByBBS of the file /goform
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvan
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_p
- 9.8 Critical severity
RE6500: Improper Neutralization of Special Elements used in an OS Command
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The ma
- 8.8 High severity
RE6500: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument
- 8.8 High severity
RE6500: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rated as critical. Affected by this issue is the function verifyFacebookLike of the file /goform/verifyF
- 8.8 High severity
RE6500: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The ma
- 9.8 Critical severity
FGW3000-AH: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel_sw of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of
- 9.8 Critical severity
FGW3000-AH: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153FC of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of th
- 9.8 Critical severity
E5600 Firmware: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter.
- 9.8 Critical severity
E5600 Firmware: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.
- 9.8 Critical severity
E5600 Firmware: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.
- 9.8 Critical severity
E5600 Firmware: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter.
- 8.6 High severity
E5600 Firmware: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
- 7.3 High severity
Wap610n Firmware: Buffer Copy without Checking Size of Input
Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability.
- 9.8 Critical severity
WRT54G: Out-of-bounds Write
A vulnerability was found in Linksys WRT54G 4.21.5. It has been rated as critical. Affected by this issue is the function validate_services_port of the file /apply.cgi of the component POST Parameter Handler. The manipulation of the argument services_array lea
- 8.8 High severity
e1500_firmware: Improper Neutralization of Special Elements used in an OS Command
A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an authenticated attacker can execute OS commands with root privileges.
- 8.0 High severity
e2500_firmware: Improper Control of Generation of Code
A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via the hnd_parentalctrl_unblock function.
- 8.8 High severity
re7000_firmware: Improper Access Control
Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights.
- 8.0 High severity
e1700_firmware: Improper Neutralization of Special Elements used in a Command
An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function.
- 7.5 High severity
WRT54GL: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The e
- 7.2 High severity
E2000 Firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttc
- 7.2 High severity
E2000 Firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the
- 7.2 High severity
Wrt54gl Firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_
- 7.2 High severity
WRT54GL Wireless-G Broadband Router: Improper Neutralization of Special Elements used in an OS Command
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated
- 7.5 High severity
WRT54GL Wireless-G Broadband Router: NULL Pointer Dereference
A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the soap_action function within the upnp binary can be triggered by an unauthenticated attacker via a mal
- 7.2 High severity
Linksys WUMC710 Wireless-AC Universal Media…: Improper Neutralization of Special Elements used in an OS Command
An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An au
- 7.2 High severity
WRT54GL Wireless-G Broadband Router: Out-of-bounds Write
A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges t
- 7.5 High severity
E5350 Firmware: Missing Authentication for Critical Functionality
On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, S
- 8.8 High severity
MR8300 Router: Improper Neutralization of Special Elements used in an OS Command
Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sa