# CVE-2026-121616: Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 6.9 MEDIUM (v4.0)
- EPSS: no score
- CWE: CWE-787, CWE-119

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

1 posts seen since 2026-11-04.

- bluesky 2026-11-04: CVE-2026-121616 - Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write CVE ID : CVE-2026-121616    Published : Nov. 4, 2026, 2:30 a.m. \| 34 minutes ago    Description : A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is ... (https://bsky.app/profile/cve.skyfleet.blue/post/fb4az3lunrzji)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121616 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121616