Deviceways

Router

Linksys E5350

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
MediaTek MT7628AN
Get OpenWrt firmware Release listed · 25.12.6
MediaTek MT7628DAN · EWW302-A1-BL-015
Open hardware record
Hardware revision not specified
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 16 MB flash; 64 MB RAM

First installation
U-Boot TFTP + serial recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

Linksys E5350 — TechInfoDepot (github.com)Linksys E5350 — WikiDevi (github.com)

Hardware revision
v1

OpenWrt · MediaTek MT7628AN

OpenWrt · MediaTek MT7628AN — Source documentation (openwrt.org)

Installation routes recorded
U-Boot TFTP + serial recovery
Recovery routes recorded
U-Boot TFTP + serial recovery
Availability recorded by source
Available 2023

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

Linksys E5350

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID

CVE-2022-35572

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.

Check more security advisories for this device · CVE.org