Linksys WRT54GL: Traceroute diagnostic remote command injection (CVE-2026-121931)
A security vulnerability in the Traceroute Diagnostic Function of the Linksys WRT54GL (4.30.18) allows for remote OS command injection via the traceroute_ip argument.
CVE search metadata
CVE search record: CVE-2026-121931. Severity: critical. CVSS: 9.1. KEV: no. Product: WRT54GL (4.30.18). Brief: Linksys WRT54GL: Traceroute diagnostic remote command injection (CVE-2026-121931). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linksys-cve-2026-121931/
Triage facts
Revision 1- Applicability
- WRT54GL (4.30.18)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 21:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Manipulation of the argument traceroute_ip leads to OS command injection. The attack can be launched remotely. The exploit has been disclosed publicly. The vendor was contacted but did not respond. This vulnerability only affects products that are no longer supported.