An OS command injection flaw exists in the addStaticRoute function of the Linksys E1700 router firmware 1.0.0.4.003. By manipulating the staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting arguments sent to /goform/addStaticRoute, an attacker can inject arbitrary shell commands. This vulnerability can lead to full compromise of the router’s operating system, allowing an attacker to execute commands with the privileges of the router’s firmware process, potentially enabling remote control, data exfiltration, or denial of service.

The affected product is the Linksys E1700 series router running firmware version 1.0.0.4.003. No other versions or models are listed as vulnerable in the available data.

The CVSS score of 9.4 indicates a high severity. The EPSS score is not available, but the vulnerability has a publicly released exploit and can be executed remotely through the router’s web interface. It is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint from the internet, and no authentication is required to send the malicious parameters. Consequently, the exploitation likelihood is high, especially for exposed home or small business networks that expose the router’s management interface to the internet.