Critical OS Command Injection Vulnerability in Linksys WRT54GL

## Overview A critical vulnerability, CVE-2026-121931, has been identified in the Linksys WRT54GL router version 4.30.18. This flaw resides in the Traceroute Diagnostic Function and can be exploited remotely. ## Technical Details The vulnerability is linked to the function system within the file apply.cgi. An attacker can manipulate the argument traceroute_ip, which allows for OS command injection. This means that an adversary can execute arbitrary commands on the affected device. The exploit has been publicly disclosed, increasing the risk of active exploitation. ## Impact The impact of this vulnerability is severe. Successful exploitation can lead to unauthorized access to the router's operating system, potentially compromising the entire network. Given that the WRT54GL is no longer supported by the vendor, users have no official patches or updates to mitigate this risk. ## Mitigation Defenders should take immediate action by disabling the Traceroute Diagnostic Function on affected devices. If possible, consider replacing the router with a supported model. Regularly review network devices for vulnerabilities and ensure that they are updated or replaced as necessary.