Description

A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T14:17:09.710Z",
  "pubdate": "2026-10-12T14:17:09.710Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in Linksys E1700 routers up to firmware version 1.0.0.4.003.\nThe vulnerability resides within the setVlan function located in the /goform/setVlan file, which fails to properly validate the length of the user-supplied vlan_set argument.\nThis flaw allows a remote, unauthenticated attacker to inject a crafted payload, resulting in memory corruption and potentially arbitrary code execution.\nThe vulnerability poses a severe risk to device integrity and network security, as successful exploitation enables full control over the router's execution flow.\nGiven the availability of public exploits and the lack of vendor response, this vulnerability represents an active threat to all affected deployments.\nThe attack is remotely exploitable, requiring no prior authentication or administrative privileges on the target device.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow triggered by improper handling of input parameters within the device's web management interface.\nThe specific root cause is located in the setVlan function within the /goform/setVlan executable binary. When the router processes a POST request to this URI, it parses the vlan_set parameter.\nThe application fails to implement adequate bounds checking on the input length before copying the data into a fixed-size buffer allocated on the stack.\nAn attacker can exploit this by sending a specially crafted HTTP POST request where the vlan_set field contains a payload exceeding the allocated buffer capacity.\nThe excess data overflows the buffer, overwriting adjacent stack memory, including the function's return address and saved frame pointer.\nBy precisely controlling the payload, an attacker can overwrite the return address with the address of attacker-supplied shellcode or existing executable segments within the device's memory space, such as a Return-Oriented Programming (ROP) chain.\nThe attack flow proceeds as follows: First, the attacker identifies the target Linksys E1700 router accessible via the network. Second, the attacker sends an HTTP POST request targeting the /goform/setVlan endpoint, embedding a malicious payload in the vlan_set parameter. Third, the internal web server parses the request and passes the unvalidated input to the vulnerable setVlan function. Fourth, the stack-based buffer is overflowed, allowing the attacker to hijack the execution flow.\nBecause the web server process typically runs with elevated privileges on embedded Linux-based firmware, a successful exploit allows the attacker to execute arbitrary code with those same privileges.\nPost-exploitation, the attacker may gain persistence, modify system configuration, intercept network traffic, or use the device as a pivot point for further lateral movement within the local network.\nAffected firmware versions include all iterations up to and including 1.0.0.4.003, with no known security patches currently issued by the vendor to address this specific memory corruption flaw."
}