---
id: "CVE-2026-121615"
kind: "vulnerability"
aliases: ["CVE-2026-121615"]
title: "Linksys E5600 router: login handler flaw allows remote authentication bypass"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "E5600", "fixed": [], "affected": "1.1.0.26", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-bypass", "e5600", "end-of-life", "firmware", "home-router", "infrastructure", "linksys"]
not_affected_if: ["different-firmware", "no-remote-admin", "replaced-device"]
published_at: "2026-11-04T03:17:14+00:00"
first_seen_at: "2026-11-04T03:46:39+00:00"
updated_at: "2026-11-04T03:48:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121615", "first_seen_at": "2026-11-04T03:46:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T03:48:50+00:00"}]
---

# Linksys E5600 router: login handler flaw allows remote authentication bypass

A flaw in the mesh_login.cgi login handler of the Linksys E5600 router firmware 1.1.0.26 can lead to improper authentication. A remote attacker can potentially log in to the router without valid credentials, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:E5600 affected 1.1.0.26 fixed ?

## How to check

- Log in to the router admin page and read the firmware version; 1.1.0.26 is the only version named as affected, and it is also the latest Linksys has published for the E5600 (dated 12/20/2021).
- Check whether the admin interface is reachable from the internet (remote management enabled, or a port forward to the router). VulDB says the attack is remote and needs no authentication, but no source says whether the default config exposes it. Unknown; the researcher's GitHub write-up would settle it.
- Workaround (from the vendor-independent advice, not a vendor statement): turn off remote management and replace the router. VulDB says no mitigation is known.

## Timeline

- 2026-11-04T03:46:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121615
- 2026-11-04T03:48:50+00:00 analyst — VulDB VDB-430463 (CVE-2026-121615): CWE-287 on /cgi-bin/mesh_login.cgi, remote, no auth, public PoC on GitHub (link not retrieved), vendor silent, EOL. Linksys support page shows 1.1.0.26 (2021) as latest, so no fix. Not exploited in the wild per sources. Nothing marked verified: no vendor advisory exists. Default exposure of the admin interface unconfirmed. X not searched.

## Documents

- [advisory] VulDB VDB-430463: Linksys E5600 1.1.0.26 mesh_login.cgi improper authentication https://vuldb.com/vuln/430463
- [describes] Linksys E5600 downloads: latest firmware 1.1.0.26 (12/20/2021) https://support.linksys.com/kb/article/552-en/

## From the sources

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_