Description
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-04
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

A parameter in the Linksys E5350 Setup Wizard, wizard_router_pwd in /wizard/apply.cgi, can be manipulated to skip authentication checks. This allows an unauthenticated attacker to call the save_settings function and change router configuration settings, potentially granting further control over the device. The vulnerability is specifically an authentication bypass flaw.

Affected Systems

The vulnerability affects Linksys E5350 routers running firmware version 1.0.00.037. This includes the device's Setup Wizard component.

Risk and Exploitability

The CVSS score of 10 indicates critical severity. No EPSS score is reported, but the exploit has already been published and is available online. The device is not listed in CISA’s KEV catalog. Because the flaw can be triggered remotely without authentication, the risk is high and the likelihood of exploitation is significant. An attacker can remotely alter router settings, which could lead to network compromise or persistent unauthorized access.

Generated by OpenCVE AI on November 4, 2026 at 20:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router firmware to the latest version provided by Linksys that removes the authentication bypass in /wizard/apply.cgi.
  • If a firmware update is not yet available or possible, block or disable access to the /wizard path via a firewall or router ACL to prevent remote exploitation.
  • Ensure that the device’s administration password is set to a strong, unique value and verify that authentication is required for accessing the setup wizard interface.

Generated by OpenCVE AI on November 4, 2026 at 20:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication
First Time appeared Linksys
Linksys e5350
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:h:linksys:e5350:*:*:*:*:*:*:*:*
Vendors & Products Linksys
Linksys e5350
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Linksys E5350
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-04T19:15:17.845Z

Reserved: 2026-11-04T11:39:36.243Z

Link: CVE-2026-121933

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-04T20:19:11.607

Modified: 2026-11-04T20:19:11.813

Link: CVE-2026-121933

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T20:45:07Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function