{"id":"CVE-2026-127273","kind":"vulnerability","aliases":["CVE-2026-127273"],"related":[],"title":"Linksys EA8100 router: JNAP API lets remote users skip authentication","description":"A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The JNAP API on Linksys EA8100 firmware 1.0.3.216940 exposes functions such as GetWANStatus and IsAdminPasswordDefault without requiring authentication. A remote attacker can call these functions and read router status and configuration details, and public exploit code exists.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ea8100","home-router","infrastructure","jnap","linksys"],"not_affected_if":["other-firmware-versions"],"how_to_check":"- Check the router firmware version in the admin interface and compare it to `1.0.3.216940`\n- Confirm whether remote administration or WAN access to the router's web interface is enabled","fix":null,"status":"open","published_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:25+00:00","updated_at":"2026-11-13T00:41:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T00:41:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys EA8100 router: JNAP API lets remote users skip authentication","impact":"low","summary":"The JNAP API on Linksys EA8100 firmware 1.0.3.216940 exposes functions such as GetWANStatus and IsAdminPasswordDefault without requiring authentication. A remote attacker can call these functions and read router status and configuration details, and public exploit code exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","ea8100","home-router","jnap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reads router status and settings without logging in","analyst_note":"Confirm whether a vendor fix exists and whether WAN access is required; the vendor did not respond to disclosure.","how_to_check":"- Check the router firmware version in the admin interface and compare it to `1.0.3.216940`\n- Confirm whether remote administration or WAN access to the router's web interface is enabled","plain_action":"If you own a Linksys EA8100 router, check its firmware version and watch Linksys for an update, since the sources state no fix yet.","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions"],"who_is_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 are the affected population, and the flaw is reachable remotely. The sources do not say whether WAN exposure is required for the exploit. unknown on whether other firmware versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4585,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127273':13A,16A '-2026':12A,15A '1.0.3.216940':31B,69C 'affect':71C 'api':5A,26B,79C 'attack':44B,87C 'authent':10A,41B,85C 'call':46B 'carri':92C 'code':59B 'compon':77C 'configur':54B 'contact':110C 'cve':11A,14A 'detail':55B 'disclos':99C 'disclosur':114C 'ea8100':2A,17B,29B,68C 'earli':111C 'exist':60B 'exploit':58B,96C 'expos':32B 'firmwar':30B 'found':65C 'function':33B,48B,73C 'getwanstatus':36B 'getwanstatus/getwanstatus3/isadminpassworddefault':74C 'home':19B 'home-rout':18B 'infrastructur':21B 'isadminpassworddefault':38B 'jnap':4A,22B,25B,78C 'lead':82C 'let':6A 'linksi':1A,23B,28B,67C 'manipul':81C 'may':104C 'miss':84C 'possibl':89C 'public':57B,102C 'read':50B 'remot':7A,43B,94C 'requir':40B 'respond':118C 'router':3A,20B,51B 'skip':9A 'status':52B 'use':106C 'user':8A 'vendor':108C 'vulner':62C 'way':121C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 are the affected population, and the flaw is reachable remotely. The sources do not say whether WAN exposure is required for the exploit. unknown on whether other firmware versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Linksys EA8100 router, check its firmware version and watch Linksys for an update, since the sources state no fix yet.","pkeys":[],"ptokens":[],"labels":["ea8100","homerouter","infrastructure","jnap","linksys","medium"],"campaign_type":null,"search_a":"'-127273':13A,16A '-2026':12A,15A 'api':5A 'authent':10A 'cve':11A,14A 'ea8100':2A 'jnap':4A 'let':6A 'linksi':1A 'remot':7A 'router':3A 'skip':9A 'user':8A","search_b":"'1.0.3.216940':31B 'api':26B 'attack':44B 'authent':41B 'call':46B 'code':59B 'configur':54B 'detail':55B 'ea8100':17B,29B 'exist':60B 'exploit':58B 'expos':32B 'firmwar':30B 'function':33B,48B 'getwanstatus':36B 'home':19B 'home-rout':18B 'infrastructur':21B 'isadminpassworddefault':38B 'jnap':22B,25B 'linksi':23B,28B 'public':57B 'read':50B 'remot':43B 'requir':40B 'router':20B,51B 'status':52B 'without':39B","search_c":"'1.0.3.216940':69C 'affect':71C 'api':79C 'attack':87C 'authent':85C 'carri':92C 'compon':77C 'contact':110C 'disclos':99C 'disclosur':114C 'ea8100':68C 'earli':111C 'exploit':96C 'found':65C 'function':73C 'getwanstatus/getwanstatus3/isadminpassworddefault':74C 'jnap':78C 'lead':82C 'linksi':67C 'manipul':81C 'may':104C 'miss':84C 'possibl':89C 'public':102C 'remot':94C 'respond':118C 'use':106C 'vendor':108C 'vulner':62C 'way':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:20:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127273","severity":null,"published_at":"2026-11-13T00:20:13+00:00","modified_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}