CVE-2026-108892 is a critical stack-based buffer overflow in the Mac Filter component of Linksys E1700 firmware 1.0.0.4.003. It can be triggered remotely, and a public exploit has been disclosed.
What Is It
CVE-2026-108892 is a stack-based buffer overflow (CWE-121, CWE-119) in the ssid1MACFilter function. The function is reached through /goform/ssid1MACFilter in the router's Mac Filter component. Manipulating the newap_text_%d argument overflows the stack. VulDB, the CNA, published the record on 2026-10-12.
Why It Matters
The CNA rates this flaw CRITICAL under both CVSS 3.1 and CVSS 4.0. It gets the maximum score of 10.0 under CVSS 3.1 and CVSS 2.0, and 9.3 under CVSS 4.0. CVSS 2.0 has no CRITICAL tier, but 10.0 is still the top of its scale.
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity marked Proof-of-Concept
- CVSS 2.0: 10.0
The vectors show an attack over the network with low complexity. It needs no privileges and no user interaction. The impact on confidentiality, integrity and availability is high, and the CVSS 3.1 scope is "changed." The record says the exploit "has been publicly disclosed and may be utilized." A researcher write-up is linked in the references.
The CISA KEV entry supplied for this CVE is empty. KEV does not confirm active exploitation in the wild at this time.
What's Vulnerable
- Vendor: Linksys
- Product: E1700
- Affected version: firmware 1.0.0.4.003
- Component: Mac Filter (
/goform/ssid1MACFilter) - CPE:
cpe:2.3:o:linksys:e1700_firmware:*:*:*:*:*:*:*:*
The source data lists no other versions as affected or unaffected.
Patch Status
The source data names no patch or fixed firmware version. According to the CVE description, the vendor "was contacted early about this disclosure but did not respond in any way." There is no KEV entry, so CISA has set no required action or due date. If you run an E1700 on firmware 1.0.0.4.003, assume it is unpatched. Watch the Linksys site and the VulDB entry for updates.