External risk intelligence

Linksys E5350 missing authentication in Setup Wizard

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-121933

The vulnerability affects a consumer router device, specifically the management and setup interface. While these devices are typically intended for local network access, router administrative interfaces are frequently exposed to the internet in common deployment patterns due to misconfiguration or remote management features, making them a common target for external reachability.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Linksys E5350 routers that could allow remote attackers to bypass authentication, potentially leading to unauthorized access. The issue resides in the router's setup wizard and an exploit has been published, increasing the risk of it being leveraged. The vendor has not responded to disclosures regarding this vulnerability.

Authentication bypass in router setup.
Public exploit increases remote access risk.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by remotely accessing the Setup Wizard's `apply.cgi` file on a Linksys E5350 router. By manipulating the `wizard_router_pwd` argument, the attacker can bypass authentication, gaining unauthorized access. This could lead to a critical compromise of the device.

No authentication required to initiate.
Triggered by manipulating a specific argument.
Risk of critical system compromise.

Live Threat

Current exploitation, exposure, and threat context

A missing authentication flaw in the router's setup wizard could allow an unauthenticated attacker to bypass login and access sensitive settings when supported by the advisory. This may affect system configuration and potentially the device's behavior.

Router settings could be exposed.
Bypass authentication remotely.
Unauthorized access to configurations.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Linksys routers could allow remote attackers to bypass authentication and access sensitive settings. System owners or the network infrastructure team are likely responsible for this device. The first step is to identify all instances of the affected router, confirm their internet exposure and business criticality, and then coordinate with the vendor for a resolution.

Identify affected router deployments and exposure.
Confirm ownership and assess business criticality.
Coordinate vendor engagement and remediation planning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linksys E5350 router?

The Linksys E5350 is a consumer-grade wireless router designed to provide home and small office network connectivity. It includes administrative features, such as a Setup Wizard, that allow users to manage device configurations and security settings through a web-based interface.

What does CVE-2026-121933 mean for security?

This vulnerability is classified as an authentication bypass (CWE-287 and CWE-306). It means a weakness exists in the router's software logic that allows an attacker to gain control over the device without providing a valid password, effectively skipping the security gates meant to protect its configuration.

How is this vulnerability triggered?

The flaw is triggered by sending a specific, malformed request to the `apply.cgi` file within the router's Setup Wizard component. By manipulating the `wizard_router_pwd` argument, an attacker can trick the system into processing configuration changes while bypassing identity verification. This does not require any prior access to the local network.

Is my device at risk from this CVE?

If you use a Linksys E5350, you should be concerned if the device's management interface is reachable over the internet. According to Halo Surface Signal, even though these routers are typically used locally, many are accidentally exposed to the public web due to misconfigurations or enabled remote management features, making them accessible to external attackers.

How should I respond to this threat?

First, identify all Linksys E5350 units in your environment and confirm if their management interfaces are exposed to the internet. If they are, restrict access to local network connections only. Since the vendor has not provided a response, monitor for future firmware updates and consider isolating these devices from external traffic until a security fix becomes available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.