critical · CVSS v3 10 · CVSS v4 10

CVE-2026-121933

A critical flaw in Linksys E5350 routers allows remote attackers to bypass authentication by manipulating the wizard_router_pwd parameter in

Overview

A critical flaw in Linksys E5350 routers allows remote attackers to bypass authentication by manipulating the wizard_router_pwd parameter in the Setup Wizard. The vulnerability is exploitable without authentication and has a published exploit. It can lead to full administrative control over the device.

Description

A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: attackers can read and modify router configuration. Integrity: they can change settings, disable security features. Availability: they can disrupt network services. The vulnerability affects all users of the affected Linksys E5350 routers, including home and small business environments.

Remediation

Apply the vendor’s firmware update that patches the save_settings function or, if unavailable, disable the Setup Wizard or block access to /wizard/apply.cgi via firewall or router ACL. Additionally, enforce strong admin passwords and enable remote management only when necessary.

Risk context

Severity is critical with a CVSS v3 score of 10.0. No EPSS data is available, but the existence of a published exploit and lack of vendor response heighten urgency.

Affected products

  • Linksys E5350

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
10
EPSS
—

router authentication-bypass remote-exploit critical Linksys firmware setup-wizard

← All CVEs

Related CVEs

critical

CVE-2026-122051

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.

View analysis

critical

CVE-2026-122303

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

View analysis

critical

CVE-2026-122304

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.

View analysis