The vulnerability resides in the Traceroute Diagnostic Function of the Linksys WRT54GL router’s apply.cgi component. Malicious manipulation of the traceroute_ip argument permits the execution of arbitrary operating‑system commands. This results in full remote code execution with the privileges of the router’s web server process. The CVSS score of 9.4 reflects the high severity, and the description confirms that the exploit is publicly known and can be launched from afar.

Linksys WRT54GL models running firmware 4.30.18 are affected. The vulnerability specifically targets the Traceroute Diagnostic Function, a feature available in this firmware release. The device is no longer supported by the vendor, which means no official patch or security update is being published.

The exploit path is straightforward: an attacker sends a crafted HTTP request containing a malicious traceroute_ip parameter. Because the firmware does not properly validate or escape this input before passing it to a system call, the attacker can inject arbitrary shell commands. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score indicates a severe potential. Given that the device is unsupported, attackers could use this flaw to gain remote control over the router, manipulate network traffic, install persistent backdoors, or pivot to other devices on the local network.