CVE-2026-121615: Linksys E5600 Login Bypass, No Fix

On this page (7 sections)

CVE-2026-121615 is a critical improper authentication flaw in the Linksys E5600 router running firmware 1.1.0.26. According to the GitHub Advisory Database entry, the problem sits in the login handler at /cgi-bin/mesh_login.cgi, it can be reached remotely, and a public exploit exists.

The more important detail for most owners is what is missing: the advisory says the vendor was contacted early and did not respond, and that the product is no longer supported by its maintainer. Anyone who runs this router at home, in a small office or at a client site should read the mitigation steps below, because waiting for a patch may not be an option.

What was disclosed

The advisory describes an unknown function in the file /cgi-bin/mesh_login.cgi, part of the Login Handler component. Manipulating it can lead to improper authentication, and the attack can be launched remotely. The record was published on November 4, 2026.

The CVSS v4 metrics listed in the advisory are: network attack vector, low attack complexity, no attack requirements, no privileges required and no user interaction. Confidentiality, integrity and availability impact are all rated high, both for the vulnerable system and for subsequent systems. In plain terms, that describes a flaw an unauthenticated remote party could use without tricking anyone.

Only one independent publisher (the GitHub Advisory Database, which carries the NVD text) covers this so far. The NVD entry repeats the same description and is not separate confirmation. The advisory is marked unreviewed, and the technical write-up it links to is a third-party repository we have not verified.

Understanding the weakness

Improper authentication (CWE-287) means a system fails to properly verify that a caller is who they claim to be. On a router, the login handler is the gate to the admin interface. If that check can be bypassed, an attacker may be able to reach settings without knowing the password.

What an attacker could do afterwards is not described in the research, so we will not speculate on specifics. Generally, control of a router's admin interface puts every device behind it at risk, since traffic and DNS settings pass through it. Treat that as the general stakes of router compromise, not as a confirmed outcome for this CVE.

Who is exposed

Owners of a Linksys E5600 on firmware 1.1.0.26, the only version the advisory names. Other versions are not described either way.
Anyone whose router admin or mesh login page is reachable from the internet, since the attack is rated remote. Whether it also works from the local network only is not stated.
Agencies and IT providers who installed these routers for small business clients and no longer track them.
Teams that rely on a home-class router for remote access to office or store systems.

The advisory says the issue only affects products that are no longer supported. That usually means no firmware update will arrive, and none is listed here.

How to check your exposure

Start by confirming the model and firmware. These are read-only checks done in the router's own admin page.

Log in to the router's admin interface from inside your network and open the firmware or status page.
Note the model (E5600) and the firmware version. Version 1.1.0.26 is the one named in the advisory.
Check the router's remote management setting and confirm whether the admin interface is reachable from the internet.
If you manage sites for others, list every E5600 you have deployed and who owns it.

To see whether your public IP address answers on common web ports from outside, you can run a read-only scan against an address you own using the standard nmap tool from a machine outside your network. Look for open web management ports on the router's public address.

Check from an external host which common web ports answer on a public IP you own (replace the…Shell

nmap -Pn -p 80,443,8080,8443 YOUR.PUBLIC.IP.ADDRESS

An open result does not prove the router is vulnerable, and a closed one does not prove it is safe. It only tells you whether the management interface is exposed to the internet.

What to do now

No patch is listed and the vendor has not responded according to the advisory, so the goal is to reduce exposure and plan a replacement.

Identify every Linksys E5600 you own or manage.
Turn off remote or WAN-side administration on the router.
Make sure no port forwarding points to the router's admin or mesh login pages.
Restrict admin access to a trusted wired device where the router allows it.
Change the admin password and Wi-Fi passphrases, and do not reuse them elsewhere.
Check the Linksys site for any support notice, but do not count on a fix.
Plan to replace the router with a currently supported model, then reset the old one before disposal.
Review DNS and other settings for changes you did not make.

Caution. Changing router settings or resetting the device will briefly interrupt connectivity for everything behind it. Do this outside working hours and record your current configuration first, such as your ISP login details.

Tip. If the E5600 is in front of a shop or office, consider placing a supported firewall or router ahead of it until replacement. A network device that cannot be patched should not be the only thing between your systems and the internet.

Detection and monitoring

The research does not describe indicators of compromise, so there is no known signature to hunt for. Practical signs to watch for are unexpected admin logins, changed DNS servers, new port forwards, unfamiliar connected devices, or the router's configuration differing from your backup.

If you run a website or store behind this kind of router, outside checks are still useful. Webforta's certificate, DNS and uptime monitoring can flag unexpected DNS or certificate changes on your domains, which is one way a hijacked network could show up. Our guide on how to check whether a website is hacked and the steps in website hacked: what to do cover the next steps if something looks wrong.

Timeline

Known dates from the advisory
Date	Event
Before Nov 4, 2026	Researcher contacted the vendor early; no response, per the advisory
Nov 4, 2026	CVE-2026-121615 published by NVD and added to the GitHub Advisory Database
Nov 4, 2026	Advisory last updated; no patched version listed

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

CVE-2026-121615 - GitHub Advisory Databasegithub.com
CVE-2026-121615: A vulnerability was determined in Linksys E5600 1.1.0.26.nvd.nist.gov · 4 November 2026

Frequently asked questions

Is there a patch for CVE-2026-121615?

None is listed. The advisory shows patched versions as unknown, says the vendor did not respond to the disclosure, and states the product is no longer supported. Plan on mitigation and replacement rather than waiting for an update.

Which Linksys routers are affected?

The advisory names the Linksys E5600 on firmware 1.1.0.26. It does not say whether other versions or models are affected, so confirm your exact model and firmware.

Is CVE-2026-121615 being exploited in the wild?

That is unconfirmed. The advisory says the exploit has been publicly disclosed and may be used, but the CVE is not listed in CISA KEV and the research reports no confirmed attacks.

Can I fix this by turning off remote management?

It reduces exposure to the internet and is a sensible first step, since the attack is described as remote. The research does not say it fully prevents the flaw, for example from the local network, so replacing the router is still the safer long-term plan.

How serious is a 9.3 CVSS score for a home router?

The score reflects network reach, low complexity, no privileges and no user interaction, with high impact. For an unsupported device that cannot be patched, that makes limiting exposure and replacing it a priority.

Keep reading