{"id":"CVE-2026-127274","kind":"vulnerability","aliases":["CVE-2026-127274"],"related":[],"title":"Linksys EA8100 router: admin password checks lack attempt limits","description":"A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Linksys EA8100 router firmware 1.0.3.216940 does not limit repeated authentication attempts on its admin password check endpoint, so an attacker can keep guessing passwords. A public exploit exists, but the sources say exploitation is difficult and the vendor did not respond.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ea8100","home-router","infrastructure","linksys"],"not_affected_if":["other-firmware","remote-management-off"],"how_to_check":"- Check the router's firmware version in the Linksys app or admin page and compare it to `1.0.3.216940`","fix":null,"status":"open","published_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:25+00:00","updated_at":"2026-11-13T00:41:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T00:41:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys EA8100 router: admin password checks lack attempt limits","impact":"high","summary":"The Linksys EA8100 router firmware 1.0.3.216940 does not limit repeated authentication attempts on its admin password check endpoint, so an attacker can keep guessing passwords. A public exploit exists, but the sources say exploitation is difficult and the vendor did not respond.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","ea8100","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker guesses the admin password and takes over the router","analyst_note":"Check whether Linksys has released a fixed firmware for EA8100 and whether remote administration is on by default at https://nvd.nist.gov/vuln/detail/CVE-2026-127274.","how_to_check":"- Check the router's firmware version in the Linksys app or admin page and compare it to `1.0.3.216940`\n- Unknown whether a newer firmware exists; the sources do not say","plain_action":"Check your Linksys EA8100 router's firmware version and turn off remote administration if it is on; the sources do not name a fixed update.","product_name":"","needs_analyst":true,"not_affected_if":["remote-management-off","other-firmware"],"who_is_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940, especially if remote administration or the web admin interface is reachable from the internet. The sources say the attack is hard to carry out and the vendor has not responded. Routers with remote management disabled and strong admin passwords are harder to reach.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000775,"input_tokens":4599,"output_tokens":631,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-127274':12A,15A '-2026':11A,14A '/jnap/core/checkadminpassword':80C '1.0.3.216940':27B,71C 'admin':4A,36B 'affect':74C 'attack':42B,92C,99C 'attempt':8A,33B,90C 'authent':32B,89C 'check':6A,38B 'code':76C 'complex':105C 'contact':127C 'could':121C 'cve':10A,13A 'difficult':57B,113C 'disclosur':131C 'ea8100':2A,16B,24B,70C 'earli':128C 'endpoint':39B 'excess':88C 'exist':50B 'exploit':49B,55B,111C,115C 'file':79C 'firmwar':26B 'found':67C 'guess':45B 'high':102C 'home':18B 'home-rout':17B 'improp':85C 'infrastructur':20B 'keep':44B 'lack':7A 'level':103C 'limit':9A,30B 'linksi':1A,21B,23B,69C 'made':118C 'manipul':82C 'may':93C 'password':5A,37B,46B 'perform':95C 'public':48B,119C 'remot':97C 'repeat':31B 'requir':100C 'respond':63B,135C 'restrict':86C 'result':83C 'router':3A,19B,25B 'say':54B 'sourc':53B 'state':108C 'unknown':75C 'use':123C 'vendor':60B,125C 'vulner':65C,73C 'way':138C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940, especially if remote administration or the web admin interface is reachable from the internet. The sources say the attack is hard to carry out and the vendor has not responded. Routers with remote management disabled and strong admin passwords are harder to reach.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check your Linksys EA8100 router's firmware version and turn off remote administration if it is on; the sources do not name a fixed update.","pkeys":[],"ptokens":[],"labels":["ea8100","homerouter","infrastructure","linksys","low"],"campaign_type":null,"search_a":"'-127274':12A,15A '-2026':11A,14A 'admin':4A 'attempt':8A 'check':6A 'cve':10A,13A 'ea8100':2A 'lack':7A 'limit':9A 'linksi':1A 'password':5A 'router':3A","search_b":"'1.0.3.216940':27B 'admin':36B 'attack':42B 'attempt':33B 'authent':32B 'check':38B 'difficult':57B 'ea8100':16B,24B 'endpoint':39B 'exist':50B 'exploit':49B,55B 'firmwar':26B 'guess':45B 'home':18B 'home-rout':17B 'infrastructur':20B 'keep':44B 'limit':30B 'linksi':21B,23B 'password':37B,46B 'public':48B 'repeat':31B 'respond':63B 'router':19B,25B 'say':54B 'sourc':53B 'vendor':60B","search_c":"'/jnap/core/checkadminpassword':80C '1.0.3.216940':71C 'affect':74C 'attack':92C,99C 'attempt':90C 'authent':89C 'code':76C 'complex':105C 'contact':127C 'could':121C 'difficult':113C 'disclosur':131C 'ea8100':70C 'earli':128C 'excess':88C 'exploit':111C,115C 'file':79C 'found':67C 'high':102C 'improp':85C 'level':103C 'linksi':69C 'made':118C 'manipul':82C 'may':93C 'perform':95C 'public':119C 'remot':97C 'requir':100C 'respond':135C 'restrict':86C 'result':83C 'state':108C 'unknown':75C 'use':123C 'vendor':125C 'vulner':65C,73C 'way':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:20:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127274","severity":null,"published_at":"2026-11-13T00:20:13+00:00","modified_at":"2026-11-13T00:20:14+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}