Skip to content
Threat Feed
Subscribe
critical advisory updated

Linksys E5600 Out-of-Bounds Write (CVE-2026-121617)

A security flaw in Linksys E5600 version 1.1.0.26 allows for a remote out-of-bounds write via the init_multipart function.

CVE search metadata

CVE search record: CVE-2026-121617. Severity: high. CVSS: 7.5. KEV: no. Product: E5600 (1.1.0.26), E5600. Brief: Linksys E5600 Out-of-Bounds Write (CVE-2026-121617). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linksys-e5600-oob-write/

CVE search record: CVE-2026-121615. Severity: critical. CVSS: 10.0. KEV: no. Product: E5600 (1.1.0.26), E5600. Brief: Linksys E5600 Out-of-Bounds Write (CVE-2026-121617). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linksys-e5600-oob-write/

Triage facts

Revision 3
Applicability
E5600 (1.1.0.26), E5600
Evidence
Unknown
Severity
Critical
Sources
3 public sources
Freshness
Revision 3Nov 4, 16:18 UTC
Vulnerabilities
2 CVEs
Source quality
A2Roughly even chance
Revision history 2 entries · Revision 3
  1. Revision 3

    new product

    Changed: affected_products, claim_state, lastmod, references, updates

    Sources: 1

  2. Revision 2

    severity → critical; added CVE-2026-121615

    Changed: cves, lastmod, priority, priority_score, priority_signals, references, severity, updates

    Sources: 1

A security flaw (CVE-2026-121617) exists in Linksys E5600 1.1.0.26. The vulnerability affects the init_multipart function of the /cgi-bin/upload_fw.cgi file in the Header Parser component. The manipulation results in an out-of-bounds write. The attack may be launched remotely. Public exploit code is available. The vendor was contacted but did not respond. This vulnerability only affects products that are no longer supported by the maintainer.