Critical bug in Linksys RE7000 Wi-Fi extender lets attackers hijack the ping test tool

A newly published vulnerability in the Linksys RE7000 Wi-Fi range extender has been rated critical, with a CVSS score of 9.9 out of 10. That’s about as bad as these ratings get on paper. Whether it’s actually a five-alarm problem for you depends entirely on details the official record doesn’t yet settle.

What the bug actually does

According to the NVD entry for CVE-2026-86299, the flaw sits in firmware version 2.0.15 of the RE7000, a fairly common budget-friendly range extender. Specifically, it lives in a function called platform_event_pingTest, reachable through the device’s web management interface at /cgi-bin/json.cgi?PingTest. This is the “PingTest Handler” - the bit of code that lets the extender run a network ping when you ask it to check connectivity.

The problem, as described, is a manipulation of input to that handler that isn’t properly sanitised. A GitHub write-up linked from NVD’s own reference list gives this away in its filename: it describes the issue as a command injection bug. In plain terms, that means the ping-test feature can potentially be tricked into running commands chosen by an attacker, rather than just testing whether the extender can reach a given address.

So who is actually at risk

Here’s the catch that headlines with a 9.9 score often bury: exploiting this bug means reaching the extender’s management interface in the first place. That interface typically sits on your home network, not exposed directly to the open internet - unless someone has, for whatever reason, opened remote administration to the wider web, or an attacker has already gained a foothold inside your network through some other means.

So the realistic risk group is narrower than “everyone with an RE7000.” It’s people who’ve knowingly or unknowingly exposed the extender’s admin panel externally, people on shared or poorly secured networks (student halls, co-working spaces, badly configured office Wi-Fi), and anyone whose home network has already been compromised in some other way, where this bug becomes a handy way for an attacker already inside to escalate further.

If your extender’s admin login sits behind your home router with default remote-access settings left off, this is a much lower-priority worry than the score alone suggests.

What we don’t know

NVD’s listing doesn’t confirm whether Linksys has issued a patch, and there’s no indication in the available material of the bug being actively exploited in the wild - this looks like responsible disclosure territory for now, not an ongoing attack campaign. Nor is there any public figure for how many RE7000 units are actually running the affected 2.0.15 firmware versus a newer or older build. Given the device’s age and Linksys’s patchy track record on long-term firmware support for budget extenders, an official fix isn’t guaranteed to be forthcoming quickly, or at all.

What to do about it

If you own an RE7000, check the firmware version in its admin panel and look for an update from Linksys’s support site. Regardless of this specific bug, make sure the extender’s remote-management feature is switched off unless you have a genuine reason to need it - that alone closes off the most dangerous version of this attack path. If you’re not sure whether remote access is enabled, that’s worth five minutes of your time to check.

The sober takeaway: a 9.9 score reflects how bad the bug could be if conditions line up, not how likely those conditions are for the average household. This is a “check your settings and move on” situation for most people, not a reason to unplug your extender tonight.