{"id":"CVE-2026-120283","kind":"vulnerability","aliases":["CVE-2026-120283"],"related":[],"title":"Linksys E8450 router: remote stack overflow via portal.cgi timezone field","description":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Linksys E8450 firmware 1.2.00.360516 copies the hidden_timezone argument into a fixed stack buffer with strcpy in /www/cgi-bin/portal.cgi. VulDB lists it as remote, unauthenticated, with a proof of concept. VulDB says Linksys did not respond to the reporter; no fixed firmware is known.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"E8450","fixed":[],"affected":"1.2.00.360516","ecosystem":"vendor"}],"ecosystems":[],"tags":["e8450","embedded-firmware","home-router","infrastructure","linksys","no-auth"],"not_affected_if":["admin-interface-not-reachable","different-model","other-firmware-version","remote-admin-disabled"],"how_to_check":"Open the router admin page and read the firmware version; 1.2.00.360516 is the affected build. With shell access, /www/cgi-bin/portal.cgi is present. Also check whether remote management (admin reachable from the internet) is on.","fix":null,"status":"open","published_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","triaged_at":"2026-11-02T01:24:09+00:00","updated_at":"2026-11-02T01:25:07+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T01:24:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linksys E8450 router: remote stack overflow via portal.cgi timezone field","impact":"high","summary":"The Linksys E8450 router firmware 1.2.00.360516 copies the hidden_timezone argument into a fixed-size stack buffer with strcpy in /www/cgi-bin/portal.cgi. A remote attacker can send a long value to overflow the buffer, which can let them run code on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","e8450","home-router","embedded-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely","analyst_note":"Check the vendor advisory or a researcher writeup for the fixed firmware version and whether authentication is required for portal.cgi; the NVD entry gives no fix.","how_to_check":"- Check the firmware version on the router's admin page and compare it to `1.2.00.360516`\n- Look for the file `/www/cgi-bin/portal.cgi` on the device if you have shell access","plain_action":"If you own a Linksys E8450 router, check whether it runs firmware 1.2.00.360516 and consider replacing it or restricting its admin access, since the vendor has not responded to the disclosure.","needs_analyst":true,"not_affected_if":["different-model","other-firmware-version","admin-interface-not-reachable"],"who_is_affected":"Any Linksys E8450 running firmware 1.2.00.360516 that exposes the web interface to a network an attacker can reach is in scope, and the risk is highest if the admin interface is reachable from the internet. The sources do not say whether the flaw needs a logged-in session, so treat the portal.cgi endpoint as reachable without credentials until verified. Teams and households not using this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000758,"input_tokens":4137,"output_tokens":689,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor advisory or a researcher writeup for the fixed firmware version and whether authentication is required for portal.cgi; the NVD entry gives no fix.","search":"'-120283':13A,16A '-2026':12A,15A '/www/cgi-bin/portal.cgi':47B,89C '1.2.00.360516':33B,80C 'affect':81C 'argument':38B,94C 'attack':105C 'auth':29B 'base':101C 'buffer':43B,102C 'concept':58B 'contact':113C 'copi':34B 'cve':11A,14A 'disclosur':117C 'e8450':2A,17A,18B,31B,79C 'earli':114C 'embed':20B 'embedded-firmwar':19B 'execut':108C 'field':10A 'file':88C 'firmwar':21B,32B,70B 'fix':41B,69B 'function':84C 'hidden':36B,95C 'home':23B 'home-rout':22B 'identifi':76C 'infrastructur':25B 'known':72B 'lead':97C 'linksi':1A,26B,30B,61B,78C 'list':49B 'manipul':91C 'no-auth':27B 'overflow':6A,103C 'portal.cgi':8A 'proof':56B 'remot':4A,52B,109C 'report':67B 'respond':64B,121C 'router':3A,24B 'say':60B 'stack':5A,42B,100C 'stack-bas':99C 'strcpi':45B,85C 'timezon':9A,37B,96C 'unauthent':53B 'vendor':111C 'via':7A 'vuldb':48B,59B 'vulner':74C 'way':124C","nicknames":[],"mitigations":[],"who_affected":"Linksys E8450 routers running firmware 1.2.00.360516, the only version named in the reports. VulDB says no authentication is needed and the attack works remotely against portal.cgi, but does not say whether that means LAN only or the internet. Anyone without an E8450 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a Linksys E8450 router, check whether it runs firmware 1.2.00.360516 and consider replacing it or restricting its admin access, since the vendor has not responded to the disclosure.","first_public_at":"2026-11-02T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120283","severity":null,"published_at":"2026-11-02T01:17:27+00:00","modified_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","fetched_at":"2026-11-02T01:23:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120283:1332","url":null,"severity":null,"published_at":"2026-11-02T01:25:07+00:00","modified_at":"2026-11-02T01:25:07+00:00","first_seen_at":"2026-11-02T01:25:07+00:00","fetched_at":"2026-11-02T01:25:07+00:00","note":"Only secondary source (VulDB VDB-429627, 2026-11-01); no Linksys advisory or fix found, vendor silent per VulDB. PoC claimed by VulDB but not linked; GitHub Wood1314 repo covers other fields (hidden_dhcp_num, authenticated), not linked. Nothing verified. Fix status left unknown since no vendor page says none."}],"documents":[{"id":41686,"url":"https://vuldb.com/vuln/429627","title":"VulDB VDB-429627: Linksys E8450 portal.cgi hidden_timezone stack overflow","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}