CVE-2026-127273 · Infrastructure
NO FIX YET
The JNAP API on Linksys EA8100 firmware 1.0.3.216940 exposes functions such as GetWANStatus and IsAdminPasswordDefault without requiring authentication. A remote attacker can call these functions and read router status and configuration details, and public exploit code exists.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Linksys EA8100 routers running firmware 1.0.3.216940 are the affected population, and the flaw is reachable remotely. The sources do not say whether WAN exposure is required for the exploit. unknown on whether other firmware versions are affected.
Not affected if other-firmware-versions
Who cares ea8100, home-router, jnap, linksys
1.0.3.216940No fix yet, per the sources.
A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.