CVE-2026-121616 in E5600
Summary
by MITRE • 11/04/2026
A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The Linksys E5600 router, specifically running firmware version 1.1.0.26, contains a critical memory corruption flaw within its web management interface components. The vulnerability resides in the JSON Request Parser component, which is responsible for processing incoming HTTP requests to configure device settings or authenticate users. Specifically, the function strcpy located in the file /cgi-bin/mesh_login.cgi fails to perform adequate bounds checking on user-supplied input fields such as username, password, token, source, cn, and action parameters. This lack of validation allows an attacker to supply a string that exceeds the allocated buffer size defined by the application logic. When this oversized data is copied into memory using strcpy without length verification, it results in an out-of-bounds write condition. This type of error corresponds directly to CWE-787, which describes writing past the end or boundary of a buffer, and often falls under the broader category of CWE-120 for Buffer Copy without Checking Size of Input.
The operational impact of this vulnerability is severe due to its remote nature and the specific memory corruption mechanism involved. Because the flaw allows an attacker to write data beyond the intended boundaries of a variable in memory, it can potentially overwrite adjacent memory locations containing critical control data such as return addresses or function pointers on the stack or heap. This capability enables arbitrary code execution with the privileges held by the compromised process, which is typically root level within embedded Linux environments like those found in consumer routers. The vulnerability is classified under MITRE ATT&CK technique T1190, Exploit Public-Facing Application, as it targets a service exposed to untrusted networks. Furthermore, since the attack can be initiated remotely without authentication for certain configuration endpoints or through crafted packets during normal operation, it represents a significant risk to network integrity and confidentiality.
The exploitability of this vulnerability is heightened by several factors present in its current state. The vendor has not issued any patches or updates to address this flaw, leaving affected devices permanently vulnerable unless manually mitigated by the administrator. Additionally, the fact that an exploit for this specific issue is publicly available lowers the barrier to entry significantly, allowing even attackers with limited technical expertise to compromise these systems. This situation places users of unsupported hardware in a precarious position where they must rely on network-level defenses rather than software remediation. The lack of vendor support means there are no security advisories or firmware updates forthcoming to correct the underlying code defect in strcpy calls within the mesh login CGI script.
Mitigation strategies for this vulnerability focus primarily on defense-in-depth techniques since patching is not an option. Administrators should restrict access to the router's management interface by disabling remote administration features and ensuring that the web GUI is only accessible from trusted local network segments behind a firewall. Implementing strict ingress filtering at the network perimeter can help block malicious payloads targeting this specific CGI endpoint before they reach the device. Additionally, enabling intrusion detection systems with signatures capable of detecting buffer overflow attempts or anomalous HTTP request patterns may provide an additional layer of protection. Given that the hardware is end-of-life, the most robust long-term solution involves replacing the unsupported router with a model that receives regular security updates and supports modern encryption standards to ensure ongoing resilience against known exploitation techniques.