Two home router models have had critical security vulnerabilities disclosed. In the advisories prepared for the Linksys E5350 and the 360 Whole Home Router M5, the CVSS 3.1 score goes as high as 10.0. Neither product has received a fix from the vendor, and proof-of-concept code demonstrating the flaws is publicly available.
On the Linksys E5350, a blank password opens the admin panel
CVE-2026-121933 affects version 1.0.00.037 of the Linksys E5350. This is the model’s latest firmware version; the product is no longer in production. The flaw sits in the save_settings function at /wizard/apply.cgi in the setup wizard. The wizard accepts an empty admin password field, and on a factory-default device this step does not require any authentication at all.
After the wizard finishes, the device’s web server unconditionally treats the state of “wizard completed, session logged out, and password blank” as a valid pass. The result is severe: the entire management interface, including the diagnostics page where commands can be executed, becomes usable without a password. Meanwhile, the home user simply sees that setup finished normally and the internet works.
The advisory lists the vulnerability types as CWE-258 (empty password in configuration) and CWE-306 (missing authentication for critical function). The CVSS 3.1 score in the NVD is 10.0. The researcher who found the issue rates it 8.8 over the local network on their own account, meaning access from a neighboring network or a compromised device could be enough.
A hardcoded root password in the startup script of the 360 M5
CVE-2026-121609 covers version 4.0.17.1566 of the 360 Whole Home Router M5. The researcher notes that the same startup script is byte-for-byte identical on the M50 model as well.
The /etc/init.d/mpt script runs every time the device boots and starts the telnet service with a hardcoded root password. The researcher published the steps they used to run the factory firmware in an emulator and obtain a shell with this account. In other words, getting into device management does not require a known exploit, a weak configuration, or user error; being able to reach the device is enough.
The issue was classified as CWE-798 (hardcoded credentials); the advisory also mentions CWE-306 and CWE-489. The CVSS 3.1 score is 10.0, while the researcher’s own assessment is 8.7 over the local network. It is stated that the vendor was notified, but no response was received.
No patch yet, so limit access first
Neither advisory includes a vendor fix. VulDB says there is no information on a workaround and recommends replacing the affected device.
For the Linksys E5350, don’t expect a patch since software support has ended. If you plan to keep using the device, never leave the admin password blank in the setup wizard; in an existing setup, check from the admin panel that the password is actually saved. Disable remote management, place the modem behind a second router if possible, and open the management interface only from a computer connected by cable.
For the 360 M5 and M50, make sure telnet is not accessible from outside. Block port 23 on the router’s firewall, and disable remote management if that option exists. Moving the device to a separate network segment will significantly reduce the risk until the issue is fixed.
Because the proof-of-concept code is public, opportunistic attacks could start quickly. Checking the model and firmware version of the modems and routers on your home network is the most practical thing you can do this week.
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.