CVE-2026-121617

Publié : 4 novembre 2026

Modifié : 4 novembre 2026

Score CVSS

7.5

HIGH

Description détaillée

A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/Zimo-666/E5600-cves/tree/main/04-upload-fw-multipart-overflow https://vuldb.com/cve/CVE-2026-121617 https://vuldb.com/submit/1023313 https://vuldb.com/vuln/430465 https://vuldb.com/vuln/430465/cti https://www.linksys.com/

Dernières Vulnérabilités

CVE-2026-80335

In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.

VOIR DÉTAILS

CVE-2026-79405

In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed.

VOIR DÉTAILS

CVE-2026-121803

In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed.

VOIR DÉTAILS