CVE-2026-108896: Linksys E1700 setLinksysIpv6 OS Command Injection

Overview

A second critical OS command injection vulnerability has been disclosed in the Linksys E1700, affecting the same firmware build (1.0.0.4.003) as the related setDMZ flaw (CVE-2026-108895). Tracked as CVE-2026-108896, this issue sits in the setLinksysIpv6 function behind /goform/setLinksysIpv6, where the _6rd_prefix and _6rd_prefix_len parameters — used to configure IPv6 rapid deployment (6rd) tunneling — are passed into a system command without sanitization.

A proof-of-concept exploit is already public. As with the setDMZ issue, the vendor was contacted during disclosure but has not responded or released a fix.

Technical Details

How It Works

The setLinksysIpv6 handler configures 6rd IPv6 tunneling by writing the submitted prefix values into the router's underlying network configuration via a shell command. Because the _6rd_prefix and _6rd_prefix_len values are not validated or escaped before being used in that command, an attacker can embed shell metacharacters to break out of the intended prefix value and execute arbitrary commands on the device.

Exploitation requires reaching the router's management interface and submitting a crafted IPv6 configuration request — no valid IPv6 deployment or additional conditions are needed beyond that network access.

Impact Assessment

Who Is At Risk

Any Linksys E1700 running firmware 1.0.0.4.003 is exposed, particularly:

• Devices with IPv6/6rd configuration exposed on the management interface
• Routers with remote/WAN administration enabled
• Networks where an attacker has already gained LAN-level access

Potential Attack Chains

1. Reach the Admin Interface — Attacker accesses the router's web management panel over the LAN or an exposed WAN port
2. Inject via IPv6 Config — A malicious _6rd_prefix value executes attacker-controlled commands during IPv6 configuration
3. Device Takeover — Shell access on the router allows configuration tampering, firmware modification, or use as a foothold
4. Downstream Impact — A compromised router can intercept, redirect, or manipulate all traffic passing through it

Mitigation

Immediate Actions

• Disable remote/WAN management on affected routers
• Restrict IPv6/6rd configuration access to trusted administrators only
• Check for a firmware update — none has been released by Linksys as of publication
• Replace or isolate devices that cannot be patched, given the vendor's lack of response

Detection Opportunities

• Audit router configuration logs for unexpected IPv6 tunnel/6rd changes
• Watch for unusual outbound connections or persistence artifacts originating from the router
• Flag _6rd_prefix or _6rd_prefix_len values containing shell metacharacters (;, `, |, &, $())

Defence-in-Depth

• Keep consumer networking equipment segmented from critical internal systems
• Place vulnerable or unsupported routers behind a dedicated firewall
• Track end-of-life consumer hardware and plan replacement before new CVEs accumulate unpatched

Background

This flaw was disclosed alongside several other command injection and memory-corruption bugs in the same Linksys E1700 firmware release, including the setDMZ injection covered separately. Taken together, these disclosures suggest systemic input-validation gaps across the device's /goform/ endpoints. Given the public exploit and absent vendor response, treat any internet-reachable E1700 on this firmware as compromised until it can be isolated or replaced.

References

• NVD — CVE-2026-108896
• VulDB — Linksys E1700 setLinksysIpv6 OS Command Injection