CVE-2026-108895 in E1700
Summary
by MITRE • 10/12/2026
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Linksys E1700 router, specifically running firmware version 1.0.0.4.003, contains a critical security flaw within its Dynamic Host Configuration Protocol (DHCP) and firewall configuration interface. The vulnerability resides in the setDMZ function located in the /goform/setDMZ script, which is responsible for managing the Demilitarized Zone settings on the device. This feature allows administrators to expose a specific internal host directly to the internet by bypassing standard network address translation protections. However, the implementation fails to adequately sanitize user-supplied input before passing it to underlying system commands. Specifically, the MAC_addr argument, which is intended to accept only valid Media Access Control addresses for identifying devices on the local network, lacks proper validation and escaping mechanisms.
This lack of input sanitization results in a classic OS command injection vulnerability, categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. When a remote attacker submits a crafted MAC address containing shell metacharacters such as semicolons or pipe symbols, the router's backend processing logic interprets these characters not as part of the hardware identifier but as command separators. Consequently, arbitrary operating system commands are executed with the privileges of the web server process running on the embedded device. This flaw allows an attacker to achieve remote code execution without requiring authentication if the DMZ feature is accessible or through specific state manipulation techniques that bypass access controls often found in legacy firmware implementations.
The operational impact of this vulnerability is severe, as it grants attackers full control over the compromised router's operating system. An adversary can leverage this access to pivot into the internal network, intercept unencrypted traffic, modify DNS settings for phishing campaigns, or install persistent malware such as botnet agents like Mirai variants that target IoT devices. Since the exploit has been made publicly available and is actively being used in wild attacks, the risk level is elevated significantly. The vendor's failure to respond to disclosure efforts further exacerbates the situation, leaving users with no official patch or firmware update to remediate the issue through standard support channels.
Mitigation strategies for this vulnerability are limited due to the age of the device and the lack of vendor support. Users should immediately disable the DMZ feature if it is not strictly necessary for their network configuration. If disabling via the web interface is compromised, users may attempt to reset the router to factory defaults using the physical hardware button, although this will erase all custom settings including Wi-Fi credentials. Given that the device is end-of-life and unsupported, the most effective long-term mitigation is to replace the Linksys E1700 with a modern, actively maintained router model that receives regular security updates from the manufacturer. Additionally, network segmentation can help limit the blast radius if such devices must remain in use temporarily by isolating them on a separate VLAN with strict firewall rules preventing outbound connections except for necessary services.