CVE-2026-108893 is a critical stack-based buffer overflow in the /goform/setVlan endpoint of Linksys E1700 firmware up to 1.0.0.4.003; it can be triggered remotely, a public exploit exists, and the vendor did not respond to the disclosure.
What Is It
The flaw is in the setVlan function, which handles requests to /goform/setVlan on the Linksys E1700. If an attacker manipulates the vlan_set argument, the input overflows a stack buffer. NVD classifies it as CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
The CNA, VulDB, published the record on 2026-10-12. NVD lists its status as "Received," so NVD has not yet analyzed it.
Why It Matters
VulDB rates this 9.9 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H):
- Remote: it can be exploited over the network.
- Easy to trigger: attack complexity is low and no user interaction is needed.
- Login needed: the attacker must hold low-level privileges.
- Wide impact: the scope is changed, with high impact to confidentiality, integrity and availability.
Other ratings in the record: - CVSS 4.0: 8.6 HIGH, with exploit maturity marked as proof-of-concept. - CVSS 2.0: 9.0.
The description says the exploit "is publicly available and might be used," and a public write-up is linked in the references. However, CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: Linksys
- Product: E1700
- Affected versions: firmware up to and including 1.0.0.4.003
- CPE:
cpe:2.3:o:linksys:e1700_firmware:*:*:*:*:*:*:*:*
Patch Status
The source data does not mention a patch or fixed firmware version. According to the CVE description, the vendor "was contacted early about this disclosure but did not respond in any way." Because the CVE is not in KEV, there is no CISA-required action or remediation deadline.
Owners of affected E1700 devices should check Linksys's site for firmware updates. Until a fix is confirmed, treat the device as unpatched.