Live › vulnerability › CVE-2026-121615
A flaw in the mesh_login.cgi login handler of the Linksys E5600 router firmware 1.1.0.26 can lead to improper authentication. A remote attacker can potentially log in to the router without valid credentials, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:46 UTC. All times on this page are UTC.
Owners of a Linksys E5600 (hardware v1.0) running firmware 1.1.0.26, which is also the latest firmware Linksys lists. VulDB says it can be exploited remotely without authentication and that a proof of concept is public. The vendor did not respond to the researcher and VulDB lists the product as end of life, so no patch is expected. Other models, and routers whose admin page cannot be reached from outside the home network, are less exposed, but the second point is not confirmed by any source.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| E5600 | vendor | 1.1.0.26 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-121615")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.