A flaw in the setLinksysIpv6 function of the Linksys E1700 firmware 1.0.0.4.003 allows an attacker to manipulate the _6rd_prefix or _6rd_prefix_len parameters sent to the /goform/setLinksysIpv6 endpoint, leading to OS command injection. This defect permits execution of arbitrary commands on the router’s operating system, thereby compromising the confidentiality, integrity, and availability of the device and its connected network.

Affected devices are Linksys E1700 routers running firmware version 1.0.0.4.003. No other versions are explicitly listed in the CNA data.

The CVSS score of 9.4 indicates critical severity. The exploit is publicly available and can be performed remotely through the web interface without any authentication, as noted in the advisory. Though no EPSS score is published, the high score and public availability suggest a tangible risk. The vulnerability is not currently included in the CISA KEV catalog, but the lack of a vendor patch response raises concern. The attack vector is inferred to be a remote web request targeting the vulnerable API endpoint.