---
id: "CVE-2026-121616"
kind: "vulnerability"
aliases: ["CVE-2026-121616"]
title: "Linksys E5600 router: JSON request parser overflow in mesh login"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["e5600", "embedded", "home-router", "infrastructure", "linksys"]
not_affected_if: ["different-firmware", "different-model", "web-interface-not-exposed"]
published_at: "2026-11-04T03:17:15+00:00"
first_seen_at: "2026-11-04T03:46:39+00:00"
updated_at: "2026-11-04T03:47:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121616", "first_seen_at": "2026-11-04T03:46:39+00:00"}]
---

# Linksys E5600 router: JSON request parser overflow in mesh login

A flaw in the mesh_login.cgi handler of the Linksys E5600 router (firmware 1.1.0.26) lets a remote request write past a buffer through an unchecked strcpy on fields such as username and password. A successful attack can crash the router or may let an attacker run code on it; the sources do not state which.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router admin page; the affected build is `1.1.0.26`.
- Confirm whether the router is reachable from the internet or an untrusted network.

## Timeline

- 2026-11-04T03:46:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121616

## From the sources

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_