{"id":"CVE-2026-121615","kind":"vulnerability","aliases":["CVE-2026-121615"],"related":[],"title":"Linksys E5600 router: login handler flaw allows remote authentication bypass","description":"A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A flaw in the mesh_login.cgi login handler of the Linksys E5600 router firmware 1.1.0.26 can lead to improper authentication. A remote attacker can potentially log in to the router without valid credentials, and a public exploit has been disclosed.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"E5600","fixed":[],"affected":"1.1.0.26","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-bypass","e5600","end-of-life","firmware","home-router","infrastructure","linksys"],"not_affected_if":["different-firmware","no-remote-admin","replaced-device"],"how_to_check":"- Log in to the router admin page and read the firmware version; 1.1.0.26 is the only version named as affected, and it is also the latest Linksys has published for the E5600 (dated 12/20/2021).\n- Check whether the admin interface is reachable from the internet (remote management enabled, or a port forward to the router). VulDB says the attack is remote and needs no authentication, but no source says whether the default config exposes it. Unknown; the researcher's GitHub write-up would settle it.\n- Workaround (from the vendor-independent advice, not a vendor statement): turn off remote management and replace the router. VulDB says no mitigation is known.","fix":null,"status":"open","published_at":"2026-11-04T03:17:14+00:00","first_seen_at":"2026-11-04T03:46:39+00:00","triaged_at":"2026-11-04T03:47:16+00:00","updated_at":"2026-11-04T03:48:50+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-04T03:47:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys E5600 router: login handler flaw allows remote authentication bypass","impact":"high","summary":"A flaw in the mesh_login.cgi login handler of the Linksys E5600 router firmware 1.1.0.26 can lead to improper authentication. A remote attacker can potentially log in to the router without valid credentials, and a public exploit has been disclosed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","e5600","home-router","firmware"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Attacker bypasses login and takes administrative control of the router.","analyst_note":"Confirm the exact affected firmware range and whether the admin interface is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2026-121615.","how_to_check":"- Check the firmware version on the router's admin page; `1.1.0.26` is the affected version.\n- Check whether the router is reachable from the internet and whether `/cgi-bin/mesh_login.cgi` responds.\n- unknown for any other check, as the sources do not say.","plain_action":"If you own a Linksys E5600 router, check its firmware version; the vendor has not responded and the product is no longer supported, so consider replacing the router.","needs_analyst":true,"not_affected_if":["different-firmware","no-remote-admin","replaced-device"],"who_is_affected":"Owners of Linksys E5600 routers running firmware 1.1.0.26, particularly if the admin interface is reachable from the internet. The sources state the product is no longer supported by the maintainer, so no vendor patch is expected. Devices not running this firmware or not exposed to remote access are less likely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4174,"output_tokens":654,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact affected firmware range and whether the admin interface is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2026-121615.","search":"'-121615':13A,16A '-2026':12A,15A '/cgi-bin/mesh_login.cgi':87C '1.1.0.26':45B,78C 'affect':79C,135C 'allow':7A 'attack':53B,102C 'auth':19B 'auth-bypass':18B 'authent':9A,50B,100C 'bypass':10A,20B 'compon':90C 'contact':120C 'credenti':63B 'cve':11A,14A 'determin':74C 'disclos':70B,112C 'disclosur':124C 'e5600':2A,17A,21B,42B,77C 'earli':121C 'end':23B 'end-of-lif':22B 'execut':93C 'exploit':67B,108C 'file':86C 'firmwar':26B,44B 'flaw':6A,33B 'function':83C 'handler':5A,38B,92C 'home':28B 'home-rout':27B 'improp':49B,99C 'infrastructur':30B 'launch':105C 'lead':47B,97C 'life':25B 'linksi':1A,31B,41B,76C 'log':56B 'login':4A,37B,91C 'longer':140C 'maintain':144C 'manipul':95C 'may':114C 'mesh_login.cgi':36B 'potenti':55B 'product':136C 'public':66B,111C 'remot':8A,52B,106C 'respond':128C 'router':3A,29B,43B,60B 'support':141C 'unknown':82C 'util':116C 'valid':62B 'vendor':118C 'vulner':72C,133C 'way':131C 'without':61B","nicknames":[],"mitigations":[],"who_affected":"Owners of a Linksys E5600 (hardware v1.0) running firmware 1.1.0.26, which is also the latest firmware Linksys lists. VulDB says it can be exploited remotely without authentication and that a proof of concept is public. The vendor did not respond to the researcher and VulDB lists the product as end of life, so no patch is expected. Other models, and routers whose admin page cannot be reached from outside the home network, are less exposed, but the second point is not confirmed by any source.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you have a Linksys E5600 router, turn off remote management in its settings and plan to replace it with a supported model, because Linksys has not released a fix.","pkeys":["e5600"],"ptokens":["e5600"],"labels":["authbypass","critical","e5600","endoflife","firmware","homerouter","infrastructure","linksys"],"campaign_type":null,"first_public_at":"2026-11-04T03:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121615","severity":null,"published_at":"2026-11-04T03:17:14+00:00","modified_at":"2026-11-04T03:17:14+00:00","first_seen_at":"2026-11-04T03:46:39+00:00","fetched_at":"2026-11-04T03:46:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121615:1628","url":null,"severity":null,"published_at":"2026-11-04T03:48:50+00:00","modified_at":"2026-11-04T03:48:50+00:00","first_seen_at":"2026-11-04T03:48:50+00:00","fetched_at":"2026-11-04T03:48:50+00:00","note":"VulDB VDB-430463 (CVE-2026-121615): CWE-287 on /cgi-bin/mesh_login.cgi, remote, no auth, public PoC on GitHub (link not retrieved), vendor silent, EOL. Linksys support page shows 1.1.0.26 (2021) as latest, so no fix. Not exploited in the wild per sources. Nothing marked verified: no vendor advisory exists. Default exposure of the admin interface unconfirmed. X not searched."}],"documents":[{"id":63846,"url":"https://vuldb.com/vuln/430463","title":"VulDB VDB-430463: Linksys E5600 1.1.0.26 mesh_login.cgi improper authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":63847,"url":"https://support.linksys.com/kb/article/552-en/","title":"Linksys E5600 downloads: latest firmware 1.1.0.26 (12/20/2021)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}