CVE-2026-86299

CVE-2026-86299 is an OS command injection flaw in the PingTest handler of the Linksys RE7000 Wi-Fi range extender, in the platform_event_pingTest function reached via the /cgi-bin/json.cgi?PingTest endpoint on firmware 2.0.15. An attacker who can reach the device's web interface supplies crafted values in the pingTestIp, pingTestPktSize, or pingTestTimes parameters, and because those values are passed to a shell without sanitization, arbitrary operating-system commands are executed (CWE-77/CWE-78). The CVSS 4.0 score of 8.6 (High) shows the attack is launched remotely but requires low-privilege access (PR:L), meaning valid or default credentials for the management interface, and the High impact ratings across confidentiality, integrity, and availability indicate effective full compromise of the device. Anyone running a Linksys RE7000 on firmware 2.0.15 is affected; units whose admin interface is internet-exposed or that still use default credentials are the most likely targets. The exploit is described as publicly available and may be used, though no detailed PoC is catalogued; the issue is not in CISA's KEV and EPSS estimates roughly a 2% chance of exploitation within 30 days (79th percentile).

What to do: Check Linksys support for RE7000 firmware newer than 2.0.15 and upgrade as soon as a fixed release is published (no fixed version is given in the available data). Until then, keep the extender's management interface off the internet, ensure strong non-default admin credentials, and monitor for anomalous values in pingTestIp, pingTestPktSize, or pingTestTimes in requests to /cgi-bin/json.cgi?PingTest, which would indicate exploitation attempts.