Read the docs
TI-2026-84920 Aliases CVE-2026-121615GHSA-4xhr-pc2w-8qx5

Linksys E5600 Login mesh_login.cgi improper authentication

Priority MEDIUM 44CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A flaw in the Login Handler of Linksys E5600 firmware 1.1.0.26 lets a remote attacker bypass authentication through /cgi-bin/mesh_login.cgi, classified as CWE-287 (Improper Authentication). CVSS 4.0 scores it 10.0 (CRITICAL), with high impact on confidentiality, integrity and availability and no privileges or user interaction needed. The exploit has been publicly disclosed, and CISA has not added it to KEV. The vendor was contacted early but did not respond, the product is no longer supported by the maintainer, and no fixed version is listed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

EPSS 0.00754 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinksysE56001.1.0.26—No fix listedCNA
  • E5600 VendorLinksys Affected 1.1.0.26 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:linksys:e5600_firmware:*:*:*:*:*:*:*:*——Linksys
  • cpe:2.3:o:linksys:e5600_firmware:*:*:*:*:*:*:*:* Versions — — ·Linksys

Remediation

No fix is listed for the E5600, and the vendor did not respond to the disclosure. Since the product is no longer supported, replace the device with a supported model, or restrict access to the management interface and block remote access to /cgi-bin/mesh_login.cgi until replacement.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121615
  2. 2026-11-04 Alias added: GHSA-4xhr-pc2w-8qx5

References

Exploit 1

Other 1

  • TI-2025-24206 Linksys Routers E/WAG/WAP/WES/WET/WRT-Series CVSS 4.0CRITICAL 10.0
  • TI-2017-12715 OS command injection in Linksys WVBR0 CVSS 3.0CRITICAL 9.8
  • TI-2026-70977 Stack-based buffer overflow in Linksys E1700 Mac Filter CVSS 4.0CRITICAL 10.0
  • TI-2026-22199 Missing neutralization in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
  • TI-2026-22198 Missing neutralization in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
  • TI-2026-22197 Missing authentication in Linksys MR9600, Linksys MX4200 CVSS 3.1CRITICAL 9.8
See all 253 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences