{"id":"CVE-2026-127276","kind":"vulnerability","aliases":["CVE-2026-127276"],"related":[],"title":"Linksys EA8100 router: web admin cookie missing HttpOnly flag","description":"A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Web UI of the Linksys EA8100 router sets a session cookie without the HttpOnly flag, so scripts in the browser can read it. An attacker who can get script running in a logged-in admin's browser could steal the cookie and reuse the session.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ea8100","home-router","infrastructure","linksys","web-ui"],"not_affected_if":["admin-not-exposed","different-firmware"],"how_to_check":"- Log in to the router's web admin page and inspect the Set-Cookie header for the session cookie in browser developer tools; look for a missing `HttpOnly` attribute.\n- Check the firmware version under the router's settings and compare it with `1.0.3.216940`.","fix":null,"status":"open","published_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:43:05+00:00","updated_at":"2026-11-13T02:43:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T02:43:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys EA8100 router: web admin cookie missing HttpOnly flag","impact":"low","summary":"The Web UI of the Linksys EA8100 router sets a session cookie without the HttpOnly flag, so scripts in the browser can read it. An attacker who can get script running in a logged-in admin's browser could steal the cookie and reuse the session.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","ea8100","home-router","web-ui"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker steals the router admin session cookie from the browser","analyst_note":"Check the vendor advisory and the NVD page for an updated firmware version and whether the admin interface is reachable from WAN; the sources give no fix.","how_to_check":"- Log in to the router's web admin page and inspect the Set-Cookie header for the session cookie in browser developer tools; look for a missing `HttpOnly` attribute.\n- Check the firmware version under the router's settings and compare it with `1.0.3.216940`.","plain_action":"unknown","product_name":"","needs_analyst":true,"not_affected_if":["different-firmware","admin-not-exposed"],"who_is_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 who use the web admin page. Exposure depends on a remote attacker reaching the admin interface and tricking an admin into running script in their browser; the sources rate exploitation as high complexity and difficult. Routers with the admin page limited to the local network and not exposed to the internet are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000764,"input_tokens":4587,"output_tokens":610,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-127276':12A,15A '-2026':11A,14A '1.0.3.216940':79C 'admin':5A,61B 'attack':50B,104C,107C 'avail':122C 'browser':45B,63B 'character':109C 'complex':112C 'compon':87C 'consid':116C 'contact':130C 'cooki':6A,36B,67B,94C 'could':64B 'cve':10A,13A 'difficult':117C 'disclosur':134C 'ea8100':2A,16B,31B,78C 'earli':131C 'exploit':114C,119C 'flag':9A,40B,97C 'function':84C 'get':53B 'high':111C 'home':18B 'home-rout':17B 'httpon':8A,39B,96C 'identifi':75C 'impact':80C 'infrastructur':20B 'launch':102C 'lead':92C 'linksi':1A,21B,30B,77C 'log':59B 'logged-in':58B 'manipul':91C 'might':124C 'miss':7A 'possibl':100C 'public':121C 'read':47B 'remot':105C 'respond':138C 'reus':69B 'router':3A,19B,32B 'run':55B 'script':42B,54B 'session':35B,71B 'set':33B 'steal':65B 'ui':24B,27B,89C 'unknown':83C 'use':126C 'vendor':128C 'vulner':73C 'way':141C 'web':4A,23B,26B,88C 'web-ui':22B 'without':37B,95C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 who use the web admin page. Exposure depends on a remote attacker reaching the admin interface and tricking an admin into running script in their browser; the sources rate exploitation as high complexity and difficult. Routers with the admin page limited to the local network and not exposed to the internet are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ea8100","homerouter","infrastructure","linksys","low","webui"],"campaign_type":null,"search_a":"'-127276':12A,15A '-2026':11A,14A 'admin':5A 'cooki':6A 'cve':10A,13A 'ea8100':2A 'flag':9A 'httpon':8A 'linksi':1A 'miss':7A 'router':3A 'web':4A","search_b":"'admin':61B 'attack':50B 'browser':45B,63B 'cooki':36B,67B 'could':64B 'ea8100':16B,31B 'flag':40B 'get':53B 'home':18B 'home-rout':17B 'httpon':39B 'infrastructur':20B 'linksi':21B,30B 'log':59B 'logged-in':58B 'read':47B 'reus':69B 'router':19B,32B 'run':55B 'script':42B,54B 'session':35B,71B 'set':33B 'steal':65B 'ui':24B,27B 'web':23B,26B 'web-ui':22B 'without':37B","search_c":"'1.0.3.216940':79C 'attack':104C,107C 'avail':122C 'character':109C 'complex':112C 'compon':87C 'consid':116C 'contact':130C 'cooki':94C 'difficult':117C 'disclosur':134C 'ea8100':78C 'earli':131C 'exploit':114C,119C 'flag':97C 'function':84C 'high':111C 'httpon':96C 'identifi':75C 'impact':80C 'launch':102C 'lead':92C 'linksi':77C 'manipul':91C 'might':124C 'possibl':100C 'public':121C 'remot':105C 'respond':138C 'ui':89C 'unknown':83C 'use':126C 'vendor':128C 'vulner':73C 'way':141C 'web':88C 'without':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127276","severity":null,"published_at":"2026-11-13T02:18:54+00:00","modified_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}