EUVD-2026-97438
GHSA-3px7-h6cw-5c93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted /goform/setVlan request
-
ExploitOverflow stack buffer via vlan_set
-
ExecutionExecute code in router context
-
ImpactPivot or disrupt network traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and a low-privilege authenticated session (CVSS PR:L), after which a crafted request to the /goform/setVlan endpoint with an oversized vlan_set argument triggers the stack overflow. Limiting factors: the attacker must first have valid credentials or a hijacked authenticated session to reach the setVlan handler, and the management interface must be reachable from the attacker's position (typically LAN-side by default, unless remote administration is enabled, which would expand exposure to the WAN). Affected firmware is Linksys E1700 up to version 1.0.0.4.003. |
| Impact | Signals are moderately aligned but point to a targeted rather than mass-exploitation profile. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-level authentication, with high confidentiality, integrity and availability impact - consistent with authenticated remote code execution on a SOHO router. The exploit-maturity metric E:P (proof-of-concept) matches the confirmed public POC on GitHub. There is no CISA KEV listing and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; absence of KEV means there is no evidence of active exploitation. The PR:L requirement is the single biggest risk-reducer: an attacker needs valid (even low-privilege) credentials or an authenticated session to the device's web interface, which limits purely opportunistic internet-wide attack versus a true PR:N flaw. Note a possible over-scoping in the input vector: it sets SC:H/SI:H/SA:H (subsequent-system impact), but nothing in the description indicates the compromise crosses a trust boundary into another system beyond the router itself - this inflates the headline 8.6 and should be verified. Net: a real, patch-worthy flaw with working exploit code, but the authentication precondition and lack of KEV/active-exploitation evidence place it below internet-facing unauthenticated RCE in priority. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated session to the Linksys E1700 web management interface sends a crafted request to /goform/setVlan with an oversized vlan_set argument, overflowing a stack buffer in the setVlan function. A proof-of-concept is publicly available on GitHub, lowering the effort to reproduce. Successful exploitation can crash the device or achieve code execution in the router's context, giving control over network traffic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.
RemediationAI
No vendor-released patch identified at time of analysis - Linksys was contacted during coordinated disclosure and never responded, and no fixed firmware version is documented for the E1700, which is an end-of-life-class device. The most effective compensating control is to eliminate reachability of the management interface: disable WAN/remote administration so the HTTP admin service is reachable only from the LAN, and firewall or ACL-block inbound access to the router's web UI (typically TCP/80 and TCP/443) from untrusted networks; the trade-off is that you lose remote management convenience. Rotate and strengthen the admin credentials and replace default accounts, since exploitation requires an authenticated session (PR:L) - this raises the bar but does not remove the flaw. If VLAN management is not needed, avoid or restrict use of the VLAN configuration UI and treat it as a trusted-admin-only function. Segment IoT/consumer routers onto an isolated network so a compromised device cannot pivot to other assets, and monitor the device for unexpected reboots or crashes, which are the observable symptom of the overflow. Because the underlying buffer overflow cannot be mitigated without vendor code changes, the only durable fix is replacement with a supported router model that receives firmware security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in the Linksys E1700's embedded web management service. The affected code path is the setVlan handler exposed at /goform/setVlan, a goform-style CGI endpoint typical of consumer router firmware. The handler copies the user-supplied vlan_set parameter into a fixed-size stack buffer without bounds checking, so an oversized value overwrites adjacent stack memory, corrupting saved registers and the return address. Under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack is network-delivered over HTTP, requires a low-privilege authenticated session to reach the handler, and can result in full loss of confidentiality, integrity, and availability of the device. The CPE cpe:2.3:a:linksys:e1700:*:*:*:*:*:*:*:* confirms all firmware builds of the E1700 up to and including 1.0.0.4.003 are in scope. Because the overflow is a memory-safety defect rather than a logic error, the same parameter may support both denial of service (crash/reboot loops) and, with a suitable payload, control-flow hijacking on the MIPS/ARM router platform.
Know when E1700 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable management endpoint (AV:N/AC:L), but the setVlan handler needs an authenticated session so PR:L; stack overflow yields code execution on the device (C/I/A:H), no cross-system scope change (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
Stack-based buffer overflow (CWE-121) in the setVlan function of the Linksys E1700 firmware binary modform.so, reached via POST /goform/setVlan.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Linksys E1700 routers running firmware through 1.0.0.4.003 are affected by a high-severity buffer overflow that an authenticated attacker on the management network could use to crash the device or potentially execute code. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so organizations relying on these devices for branch or remote connectivity face targeted disruption or compromise risk. Leadership should care because affected routers may be internet-exposed or used in trusted network segments, and remediation depends on interim controls until Linksys provides a fix.
No vendor-released patch identified at time of analysis; interim mitigations include disabling WAN/remote management, restricting HTTP management access to trusted admin networks, enforcing strong authentication and session controls, monitoring /goform/setVlan for oversized vlan_set input, and isolating or replacing affected Linksys E1700 routers (firmware through 1.0.0.4.003).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an at
Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell c
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbit
Exploit-DB