CVE-2026-121615 is a critical improper authentication flaw in the Login Handler of Linksys E5600 firmware 1.1.0.26. It can be exploited remotely, a public exploit exists, and the affected product is no longer supported by the vendor.
What Is It
The flaw sits in an unspecified function of /cgi-bin/mesh_login.cgi, part of the router's Login Handler component. Manipulating this function leads to improper authentication (CWE-287). VulDB (the CNA) says the attack can be launched remotely and the exploit has been publicly disclosed. A researcher write-up in a GitHub repository titled "mesh-login-auth-bypass" is listed among the references.
Why It Matters
The CNA scores this as CVSS 3.1 10.0 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- It is reachable over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Scope is changed, with high impact to confidentiality, integrity and availability.
The CVSS 4.0 score is 9.3 (CRITICAL), with exploit maturity rated Proof of Concept. The CVSS 2.0 score is also 10.0.
VulDB contacted the vendor before disclosure, but the vendor "did not respond in any way." With public exploit details and no vendor engagement, defenders shouldn't expect an official fix.
Exploitation status: No CISA KEV entry was supplied for this CVE, so KEV does not currently confirm active exploitation. The NVD record says only that the exploit is public and "may be utilized."
What's Vulnerable
- Vendor: Linksys
- Product: E5600
- Affected version: firmware 1.1.0.26
- Component: Login Handler (
/cgi-bin/mesh_login.cgi) - CPE:
cpe:2.3:o:linksys:e5600_firmware:*:*:*:*:*:*:*:*
The CVE carries the unsupported-when-assigned tag. VulDB says the flaw "only affects products that are no longer supported by the maintainer."
Patch Status
The supplied data lists no patch. The product is end-of-support and the vendor did not respond to the disclosure, so a fix is unlikely. Because there's no KEV entry, no CISA required action or due date applies. Organizations still running E5600 units on firmware 1.1.0.26 should treat them as permanently exposed and plan to retire or replace them. Until then, keep the management interface off untrusted networks. NVD lists the record's status as "Deferred."