E5350 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/e5350/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:29:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinksys E5350: Authentication bypass in Setup Wizard (CVE-2026-121933)https://feed.craftedsignal.io/briefs/2026-11-linksys-router-auth-bypass/Mon, 02 Nov 2026 15:29:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linksys-router-auth-bypass/A critical authentication bypass vulnerability in the Linksys E5350 router allows remote, unauthenticated attackers to manipulate the wizard_router_pwd parameter via the /wizard/apply.cgi endpoint.CVE-2026-121933 affects the Linksys E5350 router firmware version 1.0.00.037. The vulnerability resides in the Setup Wizard component, specifically within the save_settings function of the /wizard/apply.cgi script. Attackers can bypass authentication mechanisms by manipulating the wizard_router_pwd argument. Publicly available exploit code exists for this vulnerability, and the vendor has not provided a response or a patch to date.

Impact

The vulnerability allows remote, unauthenticated attackers to gain unauthorized access or modify router settings. Given the nature of the authentication bypass, this could lead to full device compromise or administrative control.

Recommendation

  • Immediately restrict management interface access to the Linksys E5350 to trusted, internal IP ranges only.
  • Disable the Setup Wizard functionality if the device is already provisioned and in use.
  • Monitor network traffic for HTTP requests targeting /wizard/apply.cgi from untrusted or external source IPs.
  • Because no patch is available, consider isolating vulnerable devices from the public internet using an upstream firewall or ACL.
]]>criticaladvisoryvulnerabilitynetwork-security