Linksys RE7000 PingTest OS Command Injection (CVE-2026-86299)

Technical Analysis

The vulnerability resides in the platform_event_pingTest function, which fails to properly sanitize user-supplied input from the pingTestIp, pingTestPktSize, and pingTestTimes parameters before passing them to a system-level command execution routine, resulting in classic OS command injection. Because the endpoint is reachable via the device's CGI web interface, exploitation can be performed remotely and pre-authentication in many deployments, yielding root-level command execution on the router's embedded Linux OS. With a CVSS score of 9.9 and public exploit availability, this is a high-priority target for botnet operators and IoT worms similar to Mirai-class malware. Organizations using compromised routers as network infrastructure for edge devices, home offices, or branch locations running AI agent endpoints, local LLM inference gateways, or RAG data connectors could see those agents' network traffic intercepted, redirected, or used as a pivot point since a compromised router controls all traffic passing through it, including API keys and credentials transmitted by agent tooling over the local network.

Affected Systems

Linksys RE7000 range extender, firmware version 2.0.15, specifically the /cgi-bin/json.cgi PingTest Handler endpoint

Indicators of Compromise

• Endpoint: /cgi-bin/json.cgi?PingTest
• Malicious parameters: pingTestIp, pingTestPktSize, pingTestTimes
• Note: No specific hashes, IPs, or domains published at time of disclosure; monitor for injected shell metacharacters (;, |, &&, $(), backticks) in PingTest requests

Remediation Steps

1. 1

   Apply firmware update

   Check Linksys support channels for a patched firmware release beyond 2.0.15 and apply immediately once available.

2. 2

   Restrict management interface access

   Disable remote administration and restrict access to the device's web/CGI interface to trusted LAN clients only.

3. 3

   Network segmentation

   Isolate IoT and network infrastructure devices like range extenders on a separate VLAN from hosts running AI agents, LLM tooling, or sensitive credentials.

4. 4

   Monitor and filter traffic

   Deploy IDS/IPS signatures to detect command injection attempts against /cgi-bin/json.cgi and PingTest parameters.

5. 5

   Device replacement consideration

   If no patch is issued, consider replacing affected end-of-support Linksys hardware with actively maintained alternatives.