Quick answers
- Is CVE-2026-121617 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121617 being exploited in the wild.
- How severe is CVE-2026-121617?
- High severity, with a CVSS score of 7.5, published 4 November 2026.
- Which products and versions are affected?
- Linksys E5600 1.1.0.26.
- Is there a fix for CVE-2026-121617?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121617 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-121617?
- Check whether you run Linksys E5600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the init_multipart function of /cgi-bin/upload_fw.cgi. The code uses unbounded strcat() operations to append attacker-controlled multipart headers into a 1024-byte global buffer, with no size checks; each header block contributes up to 1533 bytes and the parsing loop can be re-entered multiple times, yielding attacker-controlled overflow length. The attack requires no authentication and can be exploited remotely via multipart/form-data POST requests.
Affected products
- Linksys E5600 1.1.0.26
Timeline
- 2026-11-04: disclosed
- 2026-11-04: exploited: public exploit released