CVE-2026-108893
Received Received - Intake

Stack-Based Buffer Overflow in Linksys E1700 Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108893
EUVD
EUVD-2026-97438

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys E1700 1.0.0.4.003

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in the Linksys E1700 router firmware up to version 1.0.0.4.003. The flaw exists in the setVlan function of the /goform/setVlan endpoint. An attacker can exploit this by manipulating the vlan_set argument to cause a buffer overflow, potentially leading to arbitrary code execution or system crashes. The exploit is publicly available and can be launched remotely.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable Linksys E1700 devices running firmware up to 1.0.0.4.003. Scan your network for devices with this model and firmware version. Check if the device exposes the /goform/setVlan endpoint. Use network scanning tools like nmap to identify exposed administrative interfaces.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected device, potentially gaining full control of the router. This could lead to network compromise, interception of traffic, or use of the device as part of a botnet. Users may experience device instability, unauthorized access, or loss of network connectivity.

Compliance Impact

This vulnerability could lead to unauthorized access or control of the Linksys E1700 router, potentially compromising network integrity. For GDPR, it may result in unauthorized data access or processing, violating confidentiality and integrity principles. For HIPAA, it could expose protected health information if the router is used in a healthcare environment.

Mitigation Strategies

Immediately update the Linksys E1700 firmware to the latest version if available. If no update exists, isolate the device from the network to prevent remote exploitation. Disable remote administration features if possible. Monitor network traffic for unusual activity targeting the /goform/setVlan endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart