CVE-2026-86299 in RE7000
Summary
by MITRE • 09/07/2026
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/13/2026
The Linksys RE7000 wireless range extender, specifically version 2.0.15, contains a critical remote code execution vulnerability within its web management interface. This flaw resides in the PingTest Handler component, which processes requests directed at the /cgi-bin/json.cgi endpoint with the PingTest action parameter. The specific function affected is platform_event_pingTest, responsible for executing network diagnostic pings to verify connectivity. Due to insufficient input validation and sanitization of user-supplied data, an attacker can inject arbitrary operating system commands into this process. This represents a classic instance of OS command injection, where unsanitized inputs are directly concatenated with shell commands without proper escaping or restriction of allowed characters.
The technical root cause lies in the handling of three specific arguments: pingTestIp, pingTestPktSize, and pingTestTimes. These parameters are intended to define the target IP address, packet size, and number of pings respectively. However, the underlying implementation fails to strictly validate these inputs against a whitelist of acceptable formats or characters. Instead, it appears that at least one of these values is passed directly into a system call or shell execution function without adequate filtering for command separators such as semicolons, ampersands, pipes, or backticks. This allows an attacker to terminate the intended ping operation and append malicious commands that will be executed with the privileges of the web server process, which often includes root-level access on embedded Linux devices like this range extender.
From a threat modeling perspective, this vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the use of Unix Shell commands to execute arbitrary code on a target system. The vulnerability is remotely exploitable without authentication, meaning any user connected to the local network or potentially exposed via UPnP misconfigurations can trigger it. This significantly lowers the barrier for entry, allowing unauthenticated attackers to gain full control over the device.
The operational impact of this compromise is severe and multifaceted. An attacker who successfully exploits this vulnerability gains complete command-line access to the range extender's operating system. This enables them to read sensitive configuration files containing Wi-Fi passwords, WPA keys, and administrative credentials stored in plaintext or weakly encrypted formats within the device's filesystem. Furthermore, the compromised device can be used as a pivot point for lateral movement into the internal network, allowing attackers to scan for other vulnerable devices such as routers, computers, or IoT appliances. The extender may also be recruited into botnets like Mirai to launch distributed denial-of-service attacks against external targets, degrading network performance and potentially causing service outages for legitimate users.
Mitigation strategies must address both immediate remediation and long-term security posture. The primary defense is to update the firmware on all Linksys RE7000 devices to a version that includes patches for this command injection flaw. Users should verify their current software version through the web interface or manufacturer support portal and apply updates immediately if running 2.0.15 or earlier vulnerable versions. In environments where immediate patching is not feasible, network segmentation can help isolate IoT devices from critical internal assets to limit lateral movement potential. Additionally, disabling remote management features and UPnP services reduces the attack surface by preventing external access vectors that might be leveraged in conjunction with local exploitation techniques. Regular monitoring of device logs for unusual outbound connections or high CPU usage indicative of crypto-mining activity can also aid in early detection of compromise attempts.