CVE-2026-121615

Summary

The Linksys E5600 router's Login Handler at /cgi-bin/mesh_login.cgi suffers from improper authentication (CWE-287), allowing unauthenticated remote attackers to bypass login checks and gain unauthorized access, likely leading to full device compromise given the CVSS 10.0 score.

Exploitability

Exploitation is trivial: the vulnerability is remotely exploitable without authentication, user interaction, or special privileges, and a public exploit exists.

Blast radius

Successful exploitation grants an attacker full control over the router, enabling network surveillance, DNS hijacking, malware distribution, and potential lateral movement into the internal network.

Detection

Look for HTTP POST requests to /cgi-bin/mesh_login.cgi with missing or invalid session tokens, unexpected authentication headers, or responses returning 200 OK without prior successful login; also monitor for subsequent configuration changes (e.g., DNS, admin password) logged by the device or observed via out-of-band network traffic anomalies.

Prioritized remediation

Upgrade to firmware version 1.1.0.27 or later if available; otherwise, disable the affected /cgi-bin/mesh_login.cgi endpoint immediately and isolate the device from the network until patched, as no fixed version is published in the public description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.