Linksys E1700: Stack-based buffer overflow in setVlan function
Summary
The web management endpoint /goform/setVlan of the Linksys E1700 router (firmware up to 1.0.0.4.003) copies the vlan_set argument into a stack buffer without length checks. A remote attacker who can reach this endpoint and holds low privileges may crash the router or possibly execute code on it. A public proof of concept exists, and no vendor fix has been published.
Affected
- Linksys E1700 firmware up to and including 1.0.0.4.003
- Function setVlan at /goform/setVlan, parameter vlan_set
Fixed in
Unknown. No vendor advisory or patch found. The Linksys release notes for 1.0.04 (build 3) are not verified as a fix for this issue.
Workaround
- Do not expose the web management interface to the internet and disable remote management.
- Restrict admin access to a trusted management VLAN or specific client IPs.
- Change default admin credentials to unique, strong passwords.
- Document the firmware version and check for updates regularly.
Exploitation
- Public proof of concept: yes (reporter write-up on GitHub, VulDB rates it as PoC).
- CISA SSVC: exploitation poc, automatable no.
- Exploited in the wild: nothing known; not listed in CISA KEV.
Our recommendation
- Identify all E1700 devices and record their firmware versions.
- Remove any internet-facing admin access immediately and isolate the device from guest and IoT networks.
- If no fix is available, plan replacement with a device that still receives security updates.
- Monitor for unusual admin-interface traffic or unexpected reboots.
- Recheck the NVD score once analysis is complete; the scores reported by different sources vary (8.6 to 9.9).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Reporter write-up (GitHub) github.com
- VulDB CVE-2026-108893 vuldb.com
- VulDB vulnerability 416685 vuldb.com
- OpenCVE CVE-2026-108893 app.opencve.io
- Strix CVE-2026-108893 www.strix.ai
- Hol.org CVE-2026-108893 hol.org
- Linksys E1700 release notes 1.0.04 downloads.linksys.com
- Linksys www.linksys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:51.
Original description (NVD)
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.