CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-108896 — A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the functio...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 9.9. Published: 2026-10-12T15:17:07.423.

Indicators of Compromise (2)

CVE (1)
CVE-2026-108896
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 12, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.

The Hacker News
MEDIUMVulnerability

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training. The post Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

PHP Announces Critical Security Release for Two Vulnerabilities

On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public […]

Qualys Blog