Description
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linksys | RE7000 | 2.0.15 | — |
References
- VDB-399463 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection vdb-entry technical-description
- VDB-399463 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-86299 | CVE Analysis and Report third-party-advisory
- Submit #906547 | Linksys RE7000 v2 2.0.15 Command Injection third-party-advisory
- https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md exploit
- https://www.linksys.com/ product