Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-86299: Linksys RE7000 allows remote command execution via PingTest
CVE-2026-86299 · published 1 month ago
Summary
The PingTest feature on the Linksys RE7000 router can be tricked into running commands on the device when certain input values are supplied. An attacker on the network could use this to take control of the router or disrupt its operation. Apply the latest firmware update from Linksys or disable the PingTest function until the issue is fixed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linksys | re7000 | 2.0.15 |
Original advisory text
Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published7 Sep 2026
Updated7 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta