CVE-2026-121616

Publié : 4 novembre 2026

Modifié : 4 novembre 2026

Score CVSS

5.3

MEDIUM

Description détaillée

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://github.com/Zimo-666/E5600-cves/tree/main/03-mesh-login-global-overflow https://vuldb.com/cve/CVE-2026-121616 https://vuldb.com/submit/1023312 https://vuldb.com/vuln/430464 https://vuldb.com/vuln/430464/cti https://www.linksys.com/

Dernières Vulnérabilités

CVE-2026-80335

In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.

VOIR DÉTAILS

CVE-2026-79405

In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed.

VOIR DÉTAILS

CVE-2026-121803

In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.

VOIR DÉTAILS