The Linksys RE7000 range extender is vulnerable to remote command injection with root-level privileges, posing a critical risk to network integrity and device control.

This vulnerability exists within the platform_event_pingTest function of the PingTest handler. An attacker can inject arbitrary OS commands into the pingTestIp, pingTestPktSize, or pingTestTimes parameters, which are then improperly concatenated into a command string and executed via the system() function with root privileges. While the service requires a session ID, the authentication mechanism is flawed due to predictable session tokens derived from system uptime, allowing for unauthenticated or minimally privileged exploitation.

Successful exploitation grants an attacker full root-level control over the range extender, facilitating unauthorized access to the local network, traffic interception, or the use of the device as a pivot point for further attacks. Given the CVSS score of 9.9, this vulnerability represents a critical threat to organizational security, potentially leading to total compromise of internal communications and significant reputational damage.

Immediate Action: Update the firmware of the Linksys RE7000 to the latest available version provided by the manufacturer. If an official patch is not immediately available, restrict access to the device management interface to trusted administrative subnets only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections originating from the range extender, particularly those involving common command shells or unauthorized network scanning. Review system logs for unexpected execution of shell commands or suspicious modifications to system files.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network inspection tool to filter inbound requests to the /cgi-bin/json.cgi endpoint, specifically looking for shell metacharacters such as semicolons, pipes, or backticks within the PingTest parameters.

Public Exploit Available: Yes, a detailed technical write-up and proof-of-concept are available via the referenced GitHub repository.

The severity of this vulnerability, combined with the availability of exploit details, necessitates immediate attention. Administrators must prioritize the application of vendor-supplied firmware updates to remediate the command injection flaw. Until such updates are applied, the device should be isolated from untrusted networks to prevent potential remote compromise.