Dashboard / CVE-2026-121933

CVE-2026-121933

CRITICAL
INFO Priority: 0.09 BB Relevance: 79/100
Published: 2026-11-04 Modified: 2026-11-09 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
Linksys E5350 1.0.00.037
Linksys E5350 1.0.00.037

References & Advisories (6)

https://vuldb.com/vuln/431045
vdb-entry technical-description
https://vuldb.com/submit/1024276
third-party-advisory
https://vuldb.com/vuln/431045/cti
signature permissions-required

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.98%
Raw Score 0.009770
Percentile 62.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00977
2026-11-13
0.00977
2026-11-12
0.00977
2026-11-10
0.00977
2026-11-09
0.00977
2026-11-08
0.00977
2026-11-07
0.00977
2026-11-06
0.00977
2026-11-05
0.00977

Intelligence Sources

mitre ref →
nvd ref →

External Links