CVE-2026-86299: Linksys RE7000 RCE Vulnerability

CVE-2026-86299 Overview

CVE-2026-86299 is an operating system command injection vulnerability affecting the Linksys RE7000 wireless range extender running firmware version 2.0.15. The flaw resides in the platform_event_pingTest function exposed through the /cgi-bin/json.cgi?PingTest endpoint of the PingTest Handler component. Attackers can manipulate the pingTestIp, pingTestPktSize, or pingTestTimes parameters to inject arbitrary shell commands. The vulnerability is exploitable remotely over the network and requires only low-privilege authentication. A public exploit has been disclosed, increasing the likelihood of active abuse against exposed devices.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands on the Linksys RE7000, leading to full device compromise, network pivoting, and persistent control of the range extender.

Affected Products

Linksys RE7000 firmware version 2.0.15
PingTest Handler component (/cgi-bin/json.cgi?PingTest)
platform_event_pingTest function

Discovery Timeline

2026-09-07 - CVE-2026-86299 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86299

Vulnerability Analysis

The vulnerability is classified as OS Command Injection under [CWE-77]. The Linksys RE7000 exposes a JSON-based configuration interface at /cgi-bin/json.cgi that includes a diagnostic PingTest action. When a client submits a ping test request, the platform_event_pingTest handler processes user-supplied values for the target IP address, packet size, and ping count.

These parameters are passed to an underlying shell invocation without sufficient sanitization. Attackers can append shell metacharacters such as ;, |, or backticks to any of the three fields to break out of the intended ping command. Injected commands execute in the context of the web server process, which typically runs with elevated privileges on embedded consumer network devices.

Because the range extender sits inline on the wireless network, successful exploitation enables traffic interception, credential harvesting, and lateral movement into the trusted LAN. The EPSS score of 1.98% (79.3 percentile) reflects meaningful real-world exploitation likelihood, and a public proof-of-concept has been referenced by third-party vulnerability trackers.

Root Cause

The root cause is the direct concatenation of untrusted HTTP parameter values into a shell command string within platform_event_pingTest. The handler does not enforce an allowlist for IP address syntax, does not validate that pingTestPktSize and pingTestTimes are numeric, and does not escape shell metacharacters before invoking the system shell.

Attack Vector

An attacker with low-privilege access to the device management interface sends a crafted HTTP request to /cgi-bin/json.cgi?PingTest containing malicious payloads in pingTestIp, pingTestPktSize, or pingTestTimes. If the management interface is reachable from the wireless network segment or exposed to the internet through misconfiguration, remote exploitation is straightforward. The injected commands run as the web service user, giving the attacker command execution on the embedded Linux firmware.

A public proof-of-concept is available in the GitHub advisory for Linksys RE7000 PingTest Command Injection.

Detection Methods for CVE-2026-86299

Indicators of Compromise

HTTP POST or GET requests to /cgi-bin/json.cgi?PingTest containing shell metacharacters (;, |, &, backticks, $()) in the pingTestIp, pingTestPktSize, or pingTestTimes parameters.
Unexpected outbound connections originating from the RE7000 to unknown IP addresses or command-and-control infrastructure.
Unusual processes or persistence mechanisms present on the device, such as newly spawned shells, wget/curl retrievals, or modified startup scripts.

Detection Strategies

Inspect HTTP traffic destined for RE7000 management interfaces and alert on ping test parameters that fail strict IP address and numeric validation.
Correlate authentication events against the device with immediately subsequent PingTest requests containing anomalous payloads.
Baseline the RE7000's normal outbound traffic and flag deviations such as DNS lookups to non-configured resolvers or connections to non-RFC1918 destinations.

Monitoring Recommendations

Forward router and range extender logs to a centralized log store for retention and query.
Monitor for firmware configuration changes, new administrative sessions, and unexpected reboots on RE7000 devices.
Segment IoT and consumer network equipment onto isolated VLANs so that compromise of an extender does not grant direct access to production hosts.

How to Mitigate CVE-2026-86299

Immediate Actions Required

Restrict access to the RE7000 management interface to trusted administrative hosts only and never expose it to the internet.
Change default and shared administrative credentials on all RE7000 devices to reduce the pool of accounts capable of reaching the PingTest handler.
Audit deployed RE7000 units for firmware version 2.0.15 and place vulnerable devices on isolated network segments until remediated.

Patch Information

At the time of publication, no fixed firmware version has been referenced in the available advisory data. Consult the Linksys official website and the VulDB entry for CVE-2026-86299 for updated vendor guidance and firmware releases.

Workarounds

Disable remote management and restrict the web administration interface to a wired management VLAN.
Use network access control lists on upstream routers to block untrusted clients from reaching /cgi-bin/json.cgi on the RE7000.
Consider replacing end-of-life consumer range extenders with supported hardware if the vendor does not release a patched firmware image.

bash

# Example upstream firewall rule to restrict RE7000 management access
# Allow only the administrator workstation to reach the device web UI
iptables -A FORWARD -s 192.0.2.10/32 -d 192.168.1.250/32 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.250/32 -p tcp --dport 80 -j DROP