EA8100 · CVE-2026-127275 · Infrastructure
NO FIX YET
A flaw in the JNAP API of the Linksys EA8100 router firmware (version 1.0.3.216940) lets a remote attacker call the SetRemoteSetting and SetUnsecuredWiFiWarning functions without logging in. The public exploit can change router settings such as the remote-management and Wi-Fi warning options.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of a Linksys EA8100 router running firmware 1.0.3.216940. Linksys' support page lists that build as the latest version 1 firmware, made for StarHub ISP customers. The advisory says no login is needed, so the exposure is whether the router's management interface can be reached from outside your network. Sources do not say whether other firmware versions or the v2 hardware are affected, so also check those if you run them.
Not affected if different-firmware-version, remote-management-off
Who cares ea8100, firmware, home-router, linksys, remote-management, router
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.