Linksys E1700 CVE-2026-108892

Exploitation requires the attacker to reach the router's HTTP administrative interface and send a request to the /goform/ssid1MACFilter endpoint (the Mac Filter configuration function) carrying an overlong newap_text_%d argument. The provided CVSS marks this PR:N (no privileges/unauthenticated), but this endpoint belongs to the device's admin web UI and in typical deployments is reachable only after authenticating to the router - confirm pre-auth reachability with the vendor/testing, as this is the single biggest limiter on real-world risk. Further limiting factors: the attacker must have network access to the management interface (LAN by default; only exploitable from the WAN/Internet if remote administration is enabled, which is not the default on most consumer routers), and the target must be the specific affected firmware (Linksys E1700 1.0.0.4.003). No special user interaction is required.

This is a genuine exploitation concern, though the signals are mixed and some key data is missing. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact, and a publicly disclosed POC exists (exploit maturity E:P in the vector corroborates this), so a working attack path is credible rather than theoretical. However, several real-world risk dampeners apply: no EPSS score was provided, so statistical exploitation likelihood cannot be quantified; the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation in the wild - only that exploit code has been published by the researcher (VulDB submission). A notable conflict: the provided CVSS asserts PR:N (unauthenticated), but the affected feature (/goform/ssid1MACFilter, a MAC-address-filtering configuration handler in the router's administrative web interface) is the kind of endpoint that is normally reachable only after logging into the admin panel - verify whether the endpoint is exposed pre-authentication, because if it requires an authenticated admin session the practical risk drops substantially. The vendor was contacted but did not respond and no patch is available, which raises residual risk for any still-deployed devices. Net assessment: a real, patch-unavailable buffer overflow with public exploit code on an end-of-life consumer router, but likely opportunistic/targeted rather than mass-exploited given the niche, aging product and absence of KEV/EPSS corroboration.

An attacker with network reach to the router's web management interface sends a crafted HTTP request to /goform/ssid1MACFilter, supplying an overlong value in a newap_text_%d parameter that overflows a fixed-size stack buffer in the ssid1MACFilter handler. A publicly available POC (published on GitHub by the researcher) demonstrates the overflow, which can crash the device or, with a tailored payload, execute attacker-controlled code on the router. Because the CVSS vector lists PR:N the request is characterized as unauthenticated, though in practice reachability may depend on whether the admin interface is exposed.