{"id":"CVE-2026-121616","kind":"vulnerability","aliases":["CVE-2026-121616"],"related":[],"title":"Linksys E5600 router: JSON request parser overflow in mesh login","description":"A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"A flaw in the mesh_login.cgi handler of the Linksys E5600 router (firmware 1.1.0.26) lets a remote request write past a buffer through an unchecked strcpy on fields such as username and password. A successful attack can crash the router or may let an attacker run code on it; the sources do not state which.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e5600","embedded","home-router","infrastructure","linksys"],"not_affected_if":["different-firmware","different-model","web-interface-not-exposed"],"how_to_check":"- Check the firmware version on the router admin page; the affected build is `1.1.0.26`.\n- Confirm whether the router is reachable from the internet or an untrusted network.","fix":null,"status":"open","published_at":"2026-11-04T03:17:15+00:00","first_seen_at":"2026-11-04T03:46:39+00:00","triaged_at":"2026-11-04T03:47:19+00:00","updated_at":"2026-11-04T03:47:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T03:47:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys E5600 router: JSON request parser overflow in mesh login","impact":"high","summary":"A flaw in the mesh_login.cgi handler of the Linksys E5600 router (firmware 1.1.0.26) lets a remote request write past a buffer through an unchecked strcpy on fields such as username and password. A successful attack can crash the router or may let an attacker run code on it; the sources do not state which.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","e5600","home-router","embedded"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"remote attacker may crash the router or run code on it","analyst_note":"Confirm from the NVD entry whether the overflow yields code execution or only a crash, and whether the mesh_login.cgi endpoint requires authentication.","how_to_check":"- Check the firmware version on the router admin page; the affected build is `1.1.0.26`.\n- Confirm whether the router is reachable from the internet or an untrusted network.\n- unknown for any other check, since the sources do not say.","plain_action":"If you own a Linksys E5600 router, the sources say the vendor did not respond and the product is no longer supported, so there is no patch to install; consider replacing the router.","needs_analyst":true,"not_affected_if":["different-model","different-firmware","web-interface-not-exposed"],"who_is_affected":"Owners of Linksys E5600 routers running firmware 1.1.0.26 that expose the web interface to remote requests. The sources say the product is no longer supported by its maintainer, so the flaw will likely stay unpatched. Systems not running this router model or firmware can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4195,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121616':13A,16A '-2026':12A,15A '/cgi-bin/mesh_login.cgi':96C '1.1.0.26':36B,84C 'affect':85C,149C 'argument':107C 'attack':58B,67B,117C 'avail':126C 'bound':114C 'buffer':44B 'code':69B 'compon':99C 'contact':134C 'crash':60B 'cve':11A,14A 'disclosur':138C 'e5600':2A,17B,33B,83C 'earli':135C 'embed':18B 'exploit':123C 'field':50B 'file':95C 'firmwar':35B 'flaw':25B 'function':91C 'handler':29B 'home':20B 'home-rout':19B 'identifi':80C 'infrastructur':22B 'initi':120C 'json':4A,100C 'lead':109C 'let':37B,65B 'linksi':1A,23B,32B,82C 'login':10A 'longer':154C 'maintain':158C 'manipul':104C 'may':64B,118C 'mesh':9A 'mesh_login.cgi':28B 'might':128C 'out-of-bound':111C 'overflow':7A 'parser':6A,102C 'password':55B 'past':42B 'product':150C 'public':125C 'remot':39B,121C 'request':5A,40B,101C 'respond':142C 'router':3A,21B,34B,62B 'run':68B 'sourc':73B 'state':76B 'strcpi':48B,92C 'success':57B 'support':155C 'uncheck':47B 'use':130C 'usernam':53B 'username/password/token/source/cn/action':108C 'vendor':132C 'vulner':78C,88C,147C 'way':145C 'write':41B,115C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys E5600 routers running firmware 1.1.0.26 that expose the web interface to remote requests. The sources say the product is no longer supported by its maintainer, so the flaw will likely stay unpatched. Systems not running this router model or firmware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Linksys E5600 router, the sources say the vendor did not respond and the product is no longer supported, so there is no patch to install; consider replacing the router.","pkeys":[],"ptokens":[],"labels":["e5600","embedded","homerouter","infrastructure","linksys","medium"],"campaign_type":null,"first_public_at":"2026-11-04T03:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121616","severity":null,"published_at":"2026-11-04T03:17:15+00:00","modified_at":"2026-11-04T03:17:15+00:00","first_seen_at":"2026-11-04T03:46:39+00:00","fetched_at":"2026-11-04T03:46:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}