OS Command Injection in Linksys RE7000 Range Extender

CVE-2026-86299 describes a critical remote OS command injection vulnerability discovered in the Linksys RE7000 Wi-Fi range extender, specifically in firmware version 2.0.15. The vulnerability resides within the PingTest Handler component, managed by the platform_event_pingTest function in the /cgi-bin/json.cgi?PingTest endpoint. An attacker can supply malicious input via the pingTestIp, pingTestPktSize, or pingTestTimes arguments to execute arbitrary system commands with elevated privileges. Because the device is an internet-facing network component, this flaw presents a significant risk for unauthorized system access and device takeover. Public exploit material is currently available, increasing the likelihood of active exploitation. Defenders should monitor network traffic for anomalous POST or GET requests to the identified CGI binary and prioritize patching or isolating vulnerable devices.

Impact

Successful exploitation allows for full remote code execution on the affected Linksys RE7000 range extender. This enables attackers to gain administrative control over the networking hardware, potentially facilitating traffic interception, internal network reconnaissance, or pivoting into the local area network (LAN). As a consumer networking device, this impacts the integrity and availability of home and small office network infrastructure.

Recommendation

• Immediately isolate vulnerable Linksys RE7000 devices (firmware 2.0.15) from the public internet if a firmware update is not yet available or has not been applied.
• Monitor network traffic for HTTP requests targeting /cgi-bin/json.cgi?PingTest that contain shell metacharacters such as ';', '|', '&&', or '`' within the pingTestIp, pingTestPktSize, or pingTestTimes parameters.
• Deploy firewall rules to block access to the management interface of networking devices from non-trusted or internet-facing networks.