---
id: "CVE-2026-127275"
page: "https://infrastack.ai/live/CVE-2026-127275"
kind: "vulnerability"
aliases: ["CVE-2026-127275"]
title: "Linksys EA8100 router: missing authentication lets remote users change settings"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EA8100", "fixed": [], "affected": "= 1.0.3.216940", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ea8100", "firmware", "home-router", "infrastructure", "linksys", "remote-management", "router"]
not_affected_if: ["different-firmware-version", "remote-management-off"]
published_at: "2026-11-13T00:20:14+00:00"
first_seen_at: "2026-11-13T00:41:07+00:00"
updated_at: "2026-11-13T00:42:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127275", "first_seen_at": "2026-11-13T00:41:07+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/436430", "first_seen_at": "2026-11-13T00:42:32+00:00", "cites": ["https://vuldb.com/vuln/436430", "https://support.linksys.com/kb/article/560-en/"]}]
exploit_sources: []
---

# Linksys EA8100 router: missing authentication lets remote users change settings

Link for people: https://infrastack.ai/live/CVE-2026-127275 (this .md is for agents)

A flaw in the JNAP API of the Linksys EA8100 router firmware (version 1.0.3.216940) lets a remote attacker call the SetRemoteSetting and SetUnsecuredWiFiWarning functions without logging in. The public exploit can change router settings such as the remote-management and Wi-Fi warning options.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EA8100 affected = 1.0.3.216940 fixed no fixed version listed

## How to check

- Open the Linksys app or the router admin page and read the firmware version; 1.0.3.216940 is the reported vulnerable build. Other builds are untested in the sources, so also check them.
- Check whether remote management is enabled; turn it off. The sources do not say turning it off blocks the attack, so also keep the admin page off the internet.
- The product is discontinued and the vendor has not responded; no fixed firmware is known as of 2026-11-13.

## Timeline

- 2026-11-13T00:41:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127275
- 2026-11-13T00:42:32+00:00 analyst https://vuldb.com/vuln/436430 — VulDB (CNA) entry read: EA8100 fw 1.0.3.216940, JNAP ui_server.lua, CWE-306, PoC on GitHub (link not exposed on page), vendor did not respond, no countermeasure known. Linksys support page lists 1.0.3.216940 as the latest v1 firmware (StarHub ISP build, 8/13/2026), so no newer fixed build is published; no vendor advisory found. Nothing verified: no vendor statement on fix. Search for X not run.

## Documents

- [describes] VulDB VDB-436430: Linksys EA8100 1.0.3.216940 JNAP missing authentication https://vuldb.com/vuln/436430
- [mentions] Linksys EA8100 downloads (firmware 1.0.3.216940 listed as latest for v1, StarHub) https://support.linksys.com/kb/article/560-en/

## From the sources

A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_