{"id":"CVE-2026-127275","kind":"vulnerability","aliases":["CVE-2026-127275"],"related":[],"title":"Linksys EA8100 router: missing authentication lets remote users change settings","description":"A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A flaw in the JNAP API of the Linksys EA8100 router firmware (version 1.0.3.216940) lets a remote attacker call the SetRemoteSetting and SetUnsecuredWiFiWarning functions without logging in. The public exploit can change router settings such as the remote-management and Wi-Fi warning options.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EA8100","fixed":[],"affected":"= 1.0.3.216940","ecosystem":"vendor"}],"ecosystems":[],"tags":["ea8100","firmware","home-router","infrastructure","linksys","remote-management","router"],"not_affected_if":["different-firmware-version","remote-management-off"],"how_to_check":"- Open the Linksys app or the router admin page and read the firmware version; 1.0.3.216940 is the reported vulnerable build. Other builds are untested in the sources, so also check them.\n- Check whether remote management is enabled; turn it off. The sources do not say turning it off blocks the attack, so also keep the admin page off the internet.\n- The product is discontinued and the vendor has not responded; no fixed firmware is known as of 2026-11-13.","fix":null,"status":"open","published_at":"2026-11-13T00:20:14+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:17+00:00","updated_at":"2026-11-13T00:42:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T00:41:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys EA8100 router: missing authentication lets remote users change settings","impact":"medium","summary":"A flaw in the JNAP API of the Linksys EA8100 router firmware (version 1.0.3.216940) lets a remote attacker call the SetRemoteSetting and SetUnsecuredWiFiWarning functions without logging in. The public exploit can change router settings such as the remote-management and Wi-Fi warning options.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","ea8100","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker changes router settings remotely without any login","analyst_note":"Confirm the fixed firmware version and whether vendor advisory exists; the NVD entry and sources give no fix, and the vendor did not respond.","how_to_check":"- Check the router firmware version in the Linksys app or admin page; the flawed build is `1.0.3.216940`\n- Check whether remote management is turned on in the router settings","plain_action":"If you own a Linksys EA8100 router, check its firmware version and turn off remote management until Linksys publishes a fix.","product_name":"","needs_analyst":true,"not_affected_if":["different-firmware-version","remote-management-off"],"who_is_affected":"Owners of Linksys EA8100 routers running firmware `1.0.3.216940`. The sources describe the attack as reachable remotely, so exposure depends on whether the router's management interface can be reached from the internet. The sources do not say which other firmware versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000761,"input_tokens":4607,"output_tokens":601,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether vendor advisory exists; the NVD entry and sources give no fix, and the vendor did not respond.","search":"'-127275':13A,16A '-2026':12A,15A '1.0.3.216940':42B,82C 'affect':85C 'api':34B,97C 'argument':102C 'attack':46B,113C 'authent':5A,106C 'call':47B 'caus':104C 'chang':9A,60B 'compon':95C 'contact':128C 'cve':11A,14A 'determin':78C 'disclos':120C 'disclosur':132C 'ea8100':2A,17A,18B,38B,81C 'earli':129C 'exploit':58B,116C 'fi':72B 'file':91C 'firmwar':19B,40B 'flaw':30B 'function':52B,87C 'home':21B 'home-rout':20B 'infrastructur':23B 'initi':111C 'isenabled/enabled':103C 'issu':84C 'jnap':33B,96C 'let':6A,43B 'linksi':1A,24B,37B,80C 'log':54B 'manag':27B,68B 'manipul':99C 'may':122C 'miss':4A,105C 'option':74B 'possibl':109C 'public':57B,119C 'remot':7A,26B,45B,67B,114C 'remote-manag':25B,66B 'respond':136C 'router':3A,22B,28B,39B,61B 'set':10A,62B 'setremoteset':49B 'setremotesetting/setunsecuredwifiwarning':88C 'setunsecuredwifiwarn':51B 'ui_server.lua':92C 'user':8A 'util':124C 'vendor':126C 'version':41B 'vulner':76C 'warn':73B 'way':139C 'wi':71B 'wi-fi':70B 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Owners of a Linksys EA8100 router running firmware 1.0.3.216940. Linksys' support page lists that build as the latest version 1 firmware, made for StarHub ISP customers. The advisory says no login is needed, so the exposure is whether the router's management interface can be reached from outside your network. Sources do not say whether other firmware versions or the v2 hardware are affected, so also check those if you run them.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Linksys EA8100 router, turn off remote management in its settings and consider replacing it, as Linksys has not published a fix.","pkeys":["ea8100"],"ptokens":["ea8100"],"labels":["critical","ea8100","firmware","homerouter","infrastructure","linksys","remotemanagement","router"],"campaign_type":null,"search_a":"'-127275':13A,16A '-2026':12A,15A 'authent':5A 'chang':9A 'cve':11A,14A 'ea8100':2A,17A 'let':6A 'linksi':1A 'miss':4A 'remot':7A 'router':3A 'set':10A 'user':8A","search_b":"'1.0.3.216940':42B 'api':34B 'attack':46B 'call':47B 'chang':60B 'ea8100':18B,38B 'exploit':58B 'fi':72B 'firmwar':19B,40B 'flaw':30B 'function':52B 'home':21B 'home-rout':20B 'infrastructur':23B 'jnap':33B 'let':43B 'linksi':24B,37B 'log':54B 'manag':27B,68B 'option':74B 'public':57B 'remot':26B,45B,67B 'remote-manag':25B,66B 'router':22B,28B,39B,61B 'set':62B 'setremoteset':49B 'setunsecuredwifiwarn':51B 'version':41B 'warn':73B 'wi':71B 'wi-fi':70B 'without':53B","search_c":"'1.0.3.216940':82C 'affect':85C 'api':97C 'argument':102C 'attack':113C 'authent':106C 'caus':104C 'compon':95C 'contact':128C 'determin':78C 'disclos':120C 'disclosur':132C 'ea8100':81C 'earli':129C 'exploit':116C 'file':91C 'function':87C 'initi':111C 'isenabled/enabled':103C 'issu':84C 'jnap':96C 'linksi':80C 'manipul':99C 'may':122C 'miss':105C 'possibl':109C 'public':119C 'remot':114C 'respond':136C 'setremotesetting/setunsecuredwifiwarning':88C 'ui_server.lua':92C 'util':124C 'vendor':126C 'vulner':76C 'way':139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:20:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127275","severity":null,"published_at":"2026-11-13T00:20:14+00:00","modified_at":"2026-11-13T00:20:14+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127275:3793","url":"https://vuldb.com/vuln/436430","severity":null,"published_at":"2026-11-13T00:42:32+00:00","modified_at":"2026-11-13T00:42:32+00:00","first_seen_at":"2026-11-13T00:42:32+00:00","fetched_at":"2026-11-13T00:42:32+00:00","note":"VulDB (CNA) entry read: EA8100 fw 1.0.3.216940, JNAP ui_server.lua, CWE-306, PoC on GitHub (link not exposed on page), vendor did not respond, no countermeasure known. Linksys support page lists 1.0.3.216940 as the latest v1 firmware (StarHub ISP build, 8/13/2026), so no newer fixed build is published; no vendor advisory found. Nothing verified: no vendor statement on fix. Search for X not run.","cites":["https://vuldb.com/vuln/436430","https://support.linksys.com/kb/article/560-en/"]}],"documents":[{"id":141088,"url":"https://vuldb.com/vuln/436430","title":"VulDB VDB-436430: Linksys EA8100 1.0.3.216940 JNAP missing authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":141089,"url":"https://support.linksys.com/kb/article/560-en/","title":"Linksys EA8100 downloads (firmware 1.0.3.216940 listed as latest for v1, StarHub)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}