Live › vulnerability › CVE-2026-114576
Go to dashboardThe web management interface of the Linksys RE6250 range extender (firmware 1.0.04.001) generates session_id values that are not random enough. A remote attacker who predicts a valid session ID could potentially take over an administrative session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of the Linksys RE6250 range extender running firmware with the web management interface reachable over the network. Devices where the admin interface is not reachable from untrusted networks are much less exposed. The sources do not say whether a fixed firmware exists.
1.0.04.001No product ranges from the sources yet.
1.0.04.001Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-114576")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.