CVE-2026-121617

waiting for further signals

GHSA-ch52-qqqr-2wgh ↗

no check availablenot proven exploitable

cve.orgpublic poc−25dkev

Linksys E5600 1.1.0.26

CWE-787 Out-of-bounds Write

ETK-2026-3442, permanent identifier

cvss8.7cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

4h 30msince last run

31mAI analysis

timeline

0 = cve.org publication

public poc−25dtrigger signal (cve.org) +0dwaiting for further signals+0.0d

−20d

−15d

−10d

−5d

description

Linksys E5600 firmware version 1.1.0.26 has an out-of-bounds write in header processing for its firmware-upload CGI endpoint. A remote attacker who can reach that interface may be able to corrupt memory; the available record does not specify whether authentication is required.

mitigation

Restrict access to the router administration and firmware-upload interfaces to trusted management networks only, and block them from the internet. Replace affected E5600 devices with supported hardware, as no fixed version is recorded.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

31m

cve.org record, t = 0

2026-11-04 02:45Z

Δ to public poc

−25d

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-04 02:45Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-121617
2026-11-04 03:36Z
Zimo-666/E5600-cves
github · https://github.com/Zimo-666/E5600-cves

this entry in the feed

GET /api/v1/feed/CVE-2026-121617

{
  "etk_id": "ETK-2026-3442",
  "cve_id": "CVE-2026-121617",
  "display_id": "CVE-2026-121617",
  "ghsa_id": "GHSA-ch52-qqqr-2wgh",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds write in Linksys E5600 firmware upload parser",
  "summary": "Linksys E5600 firmware version 1.1.0.26 has an out-of-bounds write in header processing for its firmware-upload CGI endpoint. A remote attacker who can reach that interface may be able to corrupt memory; the available record does not specify whether authentication is required.",
  "mitigation": "Restrict access to the router administration and firmware-upload interfaces to trusted management networks only, and block them from the internet. Replace affected E5600 devices with supported hardware, as no fixed version is recorded.",
  "vendor": "Linksys",
  "product": "E5600",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.1.0.26"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "E5600",
      "purl": null
    }
  ],
  "cwes": [
    787
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.173996816666666,
  "t0_at": "2026-11-04T02:45:20.465000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-10T14:39:56+00:00",
      "days": -24.503755381944444,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T02:45:20.465000+00:00",
      "url": "https://github.com/Zimo-666/E5600-cves"
    },
    "trigger_signal": {
      "at": "2026-11-04T02:45:20.465000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T02:45:20.465000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121617"
    }
  }
}

published 2026-11-04 03:16Z
last change 2026-11-04 04:08Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.