Live › vulnerability › CVE-2026-120283
Linksys E8450 firmware 1.2.00.360516 copies the hidden_timezone argument into a fixed stack buffer with strcpy in /www/cgi-bin/portal.cgi. VulDB lists it as remote, unauthenticated, with a proof of concept. VulDB says Linksys did not respond to the reporter; no fixed firmware is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 01:23 UTC. All times on this page are UTC.
Linksys E8450 routers running firmware 1.2.00.360516, the only version named in the reports. VulDB says no authentication is needed and the attack works remotely against portal.cgi, but does not say whether that means LAN only or the internet. Anyone without an E8450 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| E8450 | vendor | 1.2.00.360516 | – |
1.2.00.360516 is the affected buildUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120283")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.