A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. (CVE-2026-108893)

CVE-2026-108893 is a stack-based buffer overflow vulnerability in the setVlan function of the /goform/setVlan endpoint in Linksys E1700 router firmware up to version 1.0.0.4.003. The vulnerability is triggered by crafted input to the vlan_set argument, allowing remote attackers with low privileges to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The vendor was contacted but did not respond, and no official patch or mitigation has been published. Public exploit code exists, but no in-the-wild exploitation has been confirmed.

Successful exploitation can lead to full system compromise, including complete loss of confidentiality, integrity, and availability of the affected device. Remote attackers can execute arbitrary code or cause denial of service via a stack-based buffer overflow in the setVlan function. This can disrupt network operations and potentially allow further network intrusion.

No official patch or remediation is currently available from the vendor. Users should consider disabling remote management interfaces if possible and restrict network access to the affected device to trusted users only. Monitor vendor channels for any future updates or patches. Given the public availability of exploit code, affected devices should be considered at high risk until patched.