CVE-2026-121615: Improper Authentication in the Linksys E5600 Login Handler
A vulnerability tracked as CVE-2026-121615 has been published to the National Vulnerability Database for the Linksys E5600 router running firmware 1.1.0.26. The flaw sits in an unknown function of /cgi-bin/mesh_login.cgi, part of the device's Login Handler component. Manipulating the request leads to improper authentication.
The listing scores the issue at CVSS 10.0, and the entry states that the attack can be launched remotely and that the exploit has been publicly disclosed.
Key Facts
| Field | Detail |
|---|---|
| CVE | CVE-2026-121615 |
| Severity | Critical (CVSS 10.0 as listed) |
| Product | Linksys E5600 |
| Affected firmware | 1.1.0.26 |
| Component | /cgi-bin/mesh_login.cgi (Login Handler) |
| Weakness | Improper authentication |
| Attack vector | Remote |
| Exploit status | Publicly disclosed |
| Published | 2026-11-04 |
Impact
Authentication weaknesses in a router's web interface are high value to attackers. A successful bypass on a consumer or small-office gateway can expose device configuration, Wi-Fi credentials and DNS settings, and can give an attacker a foothold on the internal network. Because the exploit is already public, opportunistic scanning of exposed devices should be expected.
Note: the NVD entry was newly published and details such as a vendor advisory or fixed firmware were not available at the time of writing.
Recommended Actions
- Do not expose the router's web administration interface to the internet. Disable remote management and WAN-side access.
- Check Linksys support pages for a firmware update newer than 1.1.0.26 and apply it as soon as one is released.
- Restrict LAN access to the admin interface to a trusted management host or VLAN where possible.
- Review router configuration (DNS servers, port forwards, admin accounts) for unexpected changes.
- Plan replacement if the vendor does not issue a fix, since the device may be end-of-support.