CVE-2026-86299

Executive Summary

CVE-2026-86299 is a critical OS command injection vulnerability in the Linksys RE7000 Wi-Fi Range Extender running firmware version 2.0.15. The flaw resides in the platform_event_pingTest function within the /cgi-bin/json.cgi?PingTest endpoint of the PingTest Handler component, where the arguments pingTestIp, pingTestPktSize, and pingTestTimes are not adequately sanitized before being passed to an operating system command. This allows an authenticated remote attacker to inject arbitrary OS commands with elevated privileges on the device. With a CVSS score of 9.9, the vulnerability is considered critical, and the public availability of exploit code significantly elevates the urgency for affected organizations to remediate. Linksys has not yet released a patch, and no vendor fix is currently available.

Technical Analysis

The Linksys RE7000 is a dual-band Wi-Fi range extender designed to extend wireless coverage in home and small office networks. The device exposes a web-based management interface that processes configuration and diagnostic requests through Common Gateway Interface (CGI) scripts. Among these, the PingTest functionality is used by administrators to verify network connectivity from the device to a target host.

The vulnerability exists in the function platform_event_pingTest, which handles requests to the /cgi-bin/json.cgi?PingTest endpoint. When a user submits a ping test request, the function constructs a system-level ping command to execute. The three parameters — pingTestIp (target IP/hostname), pingTestPktSize (packet size), and pingTestTimes (number of pings) — are concatenated into this command string without proper input validation or sanitization. This constitutes a classic OS command injection flaw (CWE-77), whereby an attacker can terminate the intended command using shell metacharacters (e.g., ;, &&, |, backticks) and append arbitrary commands that will be executed by the underlying operating system.

Key characteristics of this vulnerability:

• Attack Vector: Network — the vulnerability is remotely exploitable via the HTTP management interface.
• Attack Complexity: Low — no special conditions are required beyond network reachability of the management interface and a valid low-privilege account.
• Privileges Required: Low — an attacker needs to authenticate with a low-privileged account (not administrator), indicating poor privilege separation on the management interface.
• User Interaction: None — exploitation does not require any user action.
• Scope: Changed — a compromise of the ping test functionality can potentially affect resources beyond the web application's security scope, such as other services on the device or the network segment it controls.
• Impact on Confidentiality, Integrity, and Availability: All rated High. Successful exploitation gives the attacker full command execution on the device, enabling them to read sensitive configuration data (including Wi-Fi passphrases), modify device settings, disrupt connectivity, or leverage the device as a pivot point into the broader network.

The json.cgi endpoint is a common CGI handler used across multiple Linksys router and extender products. The fact that the exploit is now public increases the likelihood of mass exploitation attempts, especially since the RE7000 is a widely deployed consumer device that is typically left with default credentials or no centralized monitoring.

Exploitation Scenarios

Although no public PoC code is available at the time of this writing, the vulnerability class and description provide a clear attack chain. The attack proceeds as follows:

Step 1: Reconnaissance and Target Identification
An attacker first identifies Linksys RE7000 devices exposed to the network. Since the device is a home/office Wi-Fi extender, it is often accessible on the local network or via the WAN if the management interface is exposed through port forwarding or UPnP. Attackers can use Shodan or similar Internet-wide scanning services with queries such as title:"Linksys RE7000" or http.html:"RE7000" to locate vulnerable instances. The management interface typically runs on standard HTTP ports (80/8080) or HTTPS (443/8443).

Step 2: Authentication and Endpoint Discovery
The attacker authenticates to the management interface using a low-privilege account. Linksys devices often have default credentials or weak passwords; alternatively, a pre-existing compromise can yield valid credentials. Once authenticated, the attacker identifies the ping test functionality endpoint, which is /cgi-bin/json.cgi?PingTest.

Step 3: Payload Injection
The attacker crafts a POST or GET request to the /cgi-bin/json.cgi?PingTest endpoint, supplying malicious values in one or more of the vulnerable arguments: pingTestIp, pingTestPktSize, or pingTestTimes. Since these parameters are concatenated into an OS command, the attacker injects shell metacharacters to break out of the intended command context. For example, the pingTestIp parameter could be set to a value like 127.0.0.1; <malicious_command>, resulting in the device executing the ping request followed by the attacker's command.

Step 4: Command Execution and Post-Exploitation
The injected command executes with the privileges of the web server process, which on embedded devices typically runs as root. This provides the attacker with full control of the device. Post-exploitation actions may include:

• Credential Theft: Reading configuration files to extract the Wi-Fi passphrase (WPA2-PSK) and administrator credentials.
• Persistent Access: Installing a reverse shell or a lightweight backdoor (e.g., via firmware modification or a cron job) to maintain access even after a reboot.
• Network Pivoting: Using the compromised extender as a foothold to attack other devices on the LAN, since the extender resides at the edge of the internal network and has visibility of all forwarded traffic.
• Denial of Service: Bricking the device or disconnecting clients by altering routing or firewall rules.
• Botnet Recruitment: Consumer routers and extenders are frequently targeted for recruitment into DDoS botnets (e.g., Mirai variants); the RE7000's processing power and always-on nature make it an ideal candidate.

It is important to note that the low privilege requirement (PR:L) combined with a scope change (S:C) indicates that even a non-administrative user account can fully compromise the device and affect resources beyond the ping test functionality. This suggests the device does not properly enforce privilege separation between the diagnostic features and the underlying system.

Impact Assessment

Business Impact: For enterprise environments, the presence of Linksys RE7000 devices — often deployed as consumer-grade extenders in remote offices, conference rooms, or temporary work sites — introduces a significant risk. Compromise of these devices provides network-level access that can be used for lateral movement, data interception (as all client traffic traverses the extender), and persistent foothold establishment.

Affected Systems: Linksys RE7000 devices running firmware version 2.0.15 are confirmed vulnerable. It is plausible, though not confirmed, that earlier firmware versions share the same code base and are equally vulnerable; security teams should assume all RE7000 devices without a patched firmware are at risk.

Blast Radius and CVSS Analysis:

• CVSS 9.9 reflects a near-maximum severity. The vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates:
  • Network attack vector: Remotely exploitable without physical access.
  • Low attack complexity: No race conditions, exotic conditions, or specialized knowledge required.
  • Low privileges required: A basic authenticated user is sufficient; no admin rights needed.
  • No user interaction: The attack does not depend on tricking a legitimate user.
  • Changed scope: The impact extends beyond the vulnerable component into the broader device and network.
  • High confidentiality/integrity/availability impact: Full device compromise, data exfiltration, configuration tampering, and denial of service are all possible.
• CWE-77 classification confirms the underlying flaw is improper neutralization of special elements used in an OS command.

Given that the exploit is public and the device is unpatched, the risk of active exploitation in the wild is elevated. The lack of CISA KEV listing does not reduce the threat — KEV is updated on a cadence and may lag behind emerging threats.

Detection Guidance

Detection of this attack requires monitoring both network traffic and device logs. The management interface of the RE7000 typically runs on standard HTTP(S) ports. The following detection content targets exploitation attempts.

Sigma Rule

title: Linksys RE7000 OS Command Injection via PingTest Endpoint
id: 7a3f7c2e-8b1d-4e5f-9a2c-3d4e5f6a7b8c
status: experimental
description: Detects HTTP requests to the Linksys RE7000 PingTest endpoint containing command injection payloads in pingTestIp, pingTestPktSize, or pingTestTimes parameters.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    http.url|contains:
      - '/cgi-bin/json.cgi?PingTest'
      - '/cgi-bin/json.cgi?pingTest'
  selection_injection_chars:
    http.url|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$(('
  selection_injection_params:
    http.url|contains:
      - 'pingTestIp='
      - 'pingTestPktSize='
      - 'pingTestTimes='
  selection_common_payloads:
    http.url|contains:
      - 'id'
      - 'whoami'
      - 'cat /etc/'
      - 'wget'
      - 'curl'
      - 'sh -i'
      - '/bin/sh'
      - 'nc '
  condition: selection_endpoint and (selection_injection_chars or selection_common_payloads)
falsepositives:
  - Legitimate ping test requests containing unusual but valid IP addresses
  - Network diagnostic tools that include semicolons in hostnames (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2026-86299
  - cwe.77

YARA Rule

rule Linksys_RE7000_PingTest_Command_Injection {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests targeting the Linksys RE7000 PingTest handler with OS command injection patterns"
        cve = "CVE-2026-86299"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $endpoint1 = "/cgi-bin/json.cgi?PingTest" ascii nocase
        $endpoint2 = "/cgi-bin/json.cgi?pingTest" ascii nocase
        $param_ip = "pingTestIp=" ascii nocase
        $param_pktsize = "pingTestPktSize=" ascii nocase
        $param_times = "pingTestTimes=" ascii nocase
        $semicolon = ";" ascii
        $pipe = "|" ascii
        $andand = "&&" ascii
        $backtick = "`" ascii
        $dollar_paren = "$(" ascii
        $sh_payload = "/bin/sh" ascii nocase
        $id_cmd = "id;" ascii nocase
        $wget_cmd = "wget " ascii nocase
        $nc_cmd = "nc " ascii nocase
    condition:
        (any of ($endpoint*) and any of ($param*)) and
        (any of ($semicolon, $pipe, $andand, $backtick, $dollar_paren) or any of ($sh_payload, $id_cmd, $wget_cmd, $nc_cmd))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86299 Linksys RE7000 PingTest OS Command Injection Attempt"; flow:established,to_server; content:"/cgi-bin/json.cgi"; http.uri; content:"PingTest"; http.uri; nocase; pcre:"/(?:pingTestIp|pingTestPktSize|pingTestTimes)=[^&\s]*?(?:;|\||&&|`|\$\(|%3B|%7C|%26%26)/Ui"; sid:202686299; rev:1; metadata:attack_target_router, deployment_perimeter, signature_severity_critical, created_at_2026_01_01, cve_CVE-2026-86299;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where destination.port in (80, 8080, 443, 8443) and
   network.protocol == "http" and
   url.path contains "/cgi-bin/json.cgi" and
   url.query contains "PingTest" and
   (url.query contains "pingTestIp" or url.query contains "pingTestPktSize" or url.query contains "pingTestTimes") and
   (url.query contains ";" or url.query contains "%3B" or url.query contains "|" or url.query contains "%7C" or
    url.query contains "&&" or url.query contains "%26%26" or url.query contains "`" or url.query contains "%60" or
    url.query contains "$(" or url.query contains "%24%28")]
  [network where destination.port in (80, 8080, 443, 8443) and
   network.protocol == "http" and
   (url.path contains "/cgi-bin/" or url.path contains "/HNAP1/" or url.path contains "/json.cgi")]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/cgi-bin/json.cgi%") AND like(uri_query, "%PingTest%")
| eval has_injection_chars = if(match(uri_query, "(pingTestIp|pingTestPktSize|pingTestTimes)=[^&\s]*(;|\||&&|`|\$\(|%3B|%7C|%26%26|%60)"), "true", "false")
| where has_injection_chars == "true"
| eval common_payload = if(match(uri_query, "(?i)(id|whoami|cat\s+/etc/|wget|curl|sh\s+-i|/bin/sh|nc\s)"), "true", "false")
| where common_payload == "true"
| table _time, src_ip, dest_ip, dest_port, uri_path, uri_query, http_method, http_user_agent, status
| sort - _time

Wazuh OSSEC Rule

<rule id="100862" level="15">
  <decodedate/>
  <field name="url">/cgi-bin/json\.cgi\?PingTest</field>
  <regex>pingTest(Ip|PktSize|Times)=[^&amp;\s]*(;|\||&amp;&amp;|`|\$\(|%3B|%7C|%26%26|%60)</regex>
  <description>CVE-2026-86299: Linksys RE7000 PingTest OS Command Injection attempt detected</description>
  <group>cve-2026-86299,command_injection,linksys_re7000,</group>
  <mitre><id>T1190</id></mitre>
  <options>no_full_log</options>
</rule>

Additionally, monitoring for abnormal outbound connections from the device (e.g., to IRC servers, unknown IPs on port 23/6667) can indicate a successful compromise where the attacker has installed a botnet client or reverse shell.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix exists as of this writing. Linksys has not acknowledged the vulnerability publicly, and no patched firmware version has been released for the RE7000.

1. Immediate Mitigations:

• Disable Remote Management: If the RE7000 management interface does not need to be accessed from the WAN, disable remote management entirely. Most consumer devices have this disabled by default, but verify.
• Restrict Network Access: Place the RE7000 behind a firewall that restricts access to the management interface (ports 80/443 or 8080/8443) to trusted administrative IP addresses only.
• Change Default Credentials: Ensure the device uses a strong, unique administrator password and that no default accounts are enabled.
• Limit Low-Privilege Accounts: If the device supports multiple user roles, disable or remove any non-administrative accounts that can access the PingTest feature.
• Segmentation: Do not place the RE7000 on the same network segment as sensitive corporate assets. Treat it as an untrusted IoT device.
• Monitor: Actively monitor logs and network traffic for exploitation attempts using the detection rules provided above.

2. Patch/Upgrade Steps:

• Check the Linksys support website (linksys.com/support) regularly for firmware updates for the RE7000. The affected version is 2.0.15; any subsequent release should be applied immediately.
• If a patch becomes available, apply it within 48 hours given the public exploit and critical rating.
• Subscribe to Linksys security advisories or RSS feeds to receive notification of firmware releases.

3. Long-Term Hardening:

• Replace the Device: Given the lack of vendor patch responsiveness and the consumer-grade nature of the device, the most secure long-term approach is to replace the RE7000 with an enterprise-grade access point or extender that receives regular security updates and has centralized management.
• Network Monitoring: Deploy network intrusion detection/prevention systems (NIDS/NIPS) at network boundaries to catch exploitation attempts against all IoT devices, not just the RE7000.
• Vulnerability Management: Add all connected devices, including IoT and networking equipment, to a comprehensive asset inventory and vulnerability scanning program.
• Zero Trust Segmentation: Implement strict network segmentation so that compromised IoT devices cannot reach critical corporate resources.

References

1. NVD Entry for CVE-2026-86299: https://nvd.nist.gov/vuln/detail/CVE-2026-86299 — Official National Vulnerability Database record containing the vulnerability description, CVSS vector, and references.
2. Linksys Official Support: https://www.linksys.com/support/ — Vendor support portal; check for RE7000 firmware updates and security advisories.
3. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application, the relevant ATT&CK technique for this vulnerability.
4. CWE-77 — Command Injection: https://cwe.mitre.org/data/definitions/77.html — Common Weakness Enumeration entry describing improper neutralization of special elements in an OS command.
5. Shodan Search for RE7000: https://www.shodan.io/search?query=title%3A%22Linksys+RE7000%22 — Shodan query results showing internet-exposed Linksys RE7000 devices that may be vulnerable.

Threat Actor Activity: No specific threat actor group has been publicly attributed to the exploitation of CVE-2026-86299. However, the public availability of exploit code and the critical severity suggest that botnet operators and opportunistic attackers will likely incorporate this into their scanning campaigns. Consumer-grade Linksys devices have been previously targeted by Mirai-based malware and similar IoT botnets, making this a plausible vector for such campaigns. The lack of CISA KEV listing should not be interpreted as an absence of active exploitation; rather, it reflects the lag time in authoritative tracking. Security teams should treat any RE7000 with an internet-exposed management interface as actively compromised until proven otherwise.