A flaw in the setDMZ handler of the Linksys E1700 firmware allows an attacker to manipulate the MAC_addr parameter and trigger arbitrary operating system commands. The injection is not limited to local input; the vulnerability can be triggered from remote networks, giving attackers direct control over the router’s operating system. This can lead to full compromise of the device, including persistence, further lateral movement, and the ability to pivot traffic through the compromised router to other parts of the network.

The vulnerability affects Linksys E1700 models running firmware version 1.0.0.4.003. No other firmware revisions were identified as vulnerable in the current public reports.

The CVSS score of 9.4 indicates a critical severity, while an EPSS score is not available, meaning the current calculated probability of exploitation is unknown. The issue is not listed in the CISA KEV catalog yet, but public exploit code has already appeared. Attackers can exploit the flaw from any remote host that has network access to the router’s management interface, as the setDMZ endpoint is accessible without authentication constraints known to this vulnerability.