CVE-2026-127276 · Infrastructure
NO FIX YET
The Web UI of the Linksys EA8100 router sets a session cookie without the HttpOnly flag, so scripts in the browser can read it. An attacker who can get script running in a logged-in admin's browser could steal the cookie and reuse the session.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Linksys EA8100 routers running firmware 1.0.3.216940 who use the web admin page. Exposure depends on a remote attacker reaching the admin interface and tricking an admin into running script in their browser; the sources rate exploitation as high complexity and difficult. Routers with the admin page limited to the local network and not exposed to the internet are less exposed.
Not affected if admin-not-exposed, different-firmware
Who cares ea8100, home-router, linksys, web-ui
HttpOnly attribute.1.0.3.216940.No fix yet, per the sources.
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.