{"id":"CVE-2026-114576","kind":"vulnerability","aliases":["CVE-2026-114576"],"related":[],"title":"Linksys RE6250 range extender: weak web session IDs allow session guessing","description":"A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.","summary":"The web management interface of the Linksys RE6250 range extender (firmware 1.0.04.001) generates session_id values that are not random enough. A remote attacker who predicts a valid session ID could potentially take over an administrative session.","severity":"low","cvss":3.7,"epss":0.0041,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-network","infrastructure","linksys","re6250","router"],"not_affected_if":["admin-interface-not-reachable","other-firmware"],"how_to_check":"- Check the firmware version in the device admin page or the Linksys app; affected version is `1.0.04.001`\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:30+00:00","updated_at":"2026-10-25T04:43:30+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:43:30Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Linksys RE6250 range extender: weak web session IDs allow session guessing","impact":"medium","summary":"The web management interface of the Linksys RE6250 range extender (firmware 1.0.04.001) generates session_id values that are not random enough. A remote attacker who predicts a valid session ID could potentially take over an administrative session.","category":"infrastructure","nicknames":[],"who_cares":["linksys","re6250","router","home-network"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker predicts session IDs and takes over the admin session","analyst_note":"Confirm whether a fixed firmware version exists and whether the web management interface is exposed to WAN by default; check NVD and the vendor advisory.","how_to_check":"- Check the firmware version in the device admin page or the Linksys app; affected version is `1.0.04.001`\n- unknown","needs_analyst":true,"not_affected_if":["other-firmware","admin-interface-not-reachable"],"who_is_affected":"Owners of the Linksys RE6250 range extender running firmware `1.0.04.001` with the web management interface reachable over the network. Devices where the admin interface is not reachable from untrusted networks are much less exposed. The sources do not say whether a fixed firmware exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000584,"input_tokens":3374,"output_tokens":493,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114576':14A,17A '-2026':13A,16A '1.0.04.001':36B,70C 'administr':60B 'affect':72C 'allow':9A 'argument':86C 'attack':48B,95C,104C 'complex':101C 'compon':78C 'could':55B 'cve':12A,15A 'difficult':115C 'disclos':120C 'enough':45B 'exploit':113C,117C 'extend':4A,34B 'firmwar':35B 'found':66C 'function':74C 'generat':37B 'guess':11A 'high':107C 'home':19B 'home-network':18B 'id':8A,39B,54B,88C 'indic':110C 'infrastructur':21B 'initi':98C 'insuffici':91C 'interfac':28B,81C 'lead':89C 'linksi':1A,22B,31B,68C 'manag':27B,80C 'manipul':83C 'may':96C,125C 'network':20B 'potenti':56B 'predict':50B 'public':123C 'random':44B,92C 'rang':3A,33B 'rather':106C 're6250':2A,23B,32B,69C 'remot':47B,99C 'router':24B 'session':7A,10A,38B,53B,61B,87C 'strcmp':75C 'take':57B 'use':127C 'valid':52B 'valu':40B,93C 'vulner':63C 'weak':5A 'web':6A,26B,79C","nicknames":[],"mitigations":[],"who_affected":"Owners of the Linksys RE6250 range extender running firmware `1.0.04.001` with the web management interface reachable over the network. Devices where the admin interface is not reachable from untrusted networks are much less exposed. The sources do not say whether a fixed firmware exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114576","severity":null,"published_at":"2026-10-22T02:16:55+00:00","modified_at":"2026-10-23T22:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114576","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114576","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}