{"id":"CVE-2026-127277","kind":"vulnerability","aliases":["CVE-2026-127277"],"related":[],"title":"Linksys EA8100 router: SMB service misconfiguration lets remote attackers in","description":"A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in improper initialization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Linksys EA8100 router's SMB file-sharing service starts with an improperly initialized ANON_ACCESS setting, so anonymous access may be allowed. A remote attacker can reach the service over the network, and a public exploit has been released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EA8100","fixed":[],"affected":"1.0.3.216940","ecosystem":"vendor"}],"ecosystems":[],"tags":["ea8100","firmware","home-router","infrastructure","linksys","smb"],"not_affected_if":["not-internet-exposed","smb-disabled"],"how_to_check":"- Admin page > firmware version: only 1.0.3.216940 is named as affected by the CNA (other versions are untested, not ruled out).\n- Check whether file sharing/SMB (USB storage sharing) is enabled and whether anonymous access is allowed; see if TCP 445/139 is reachable from the internet or from untrusted LAN/guest clients.","fix":"No fix known: VulDB reports the vendor did not respond and lists no countermeasure. Check Linksys EA8100 support downloads for newer firmware than 1.0.3.216940. Until then, disable SMB file sharing and do not expose it to the internet; VulDB suggests replacing the device.","status":"open","published_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:53+00:00","updated_at":"2026-11-13T02:44:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-13T02:42:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linksys EA8100 router: SMB service misconfiguration lets remote attackers in","impact":"medium","summary":"The Linksys EA8100 router's SMB file-sharing service starts with an improperly initialized ANON_ACCESS setting, so anonymous access may be allowed. A remote attacker can reach the service over the network, and a public exploit has been released.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["linksys","ea8100","home-router","smb"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker gains anonymous access to router file-sharing service","analyst_note":"Confirm whether the SMB service is on by default and what anonymous access grants; check NVD and any vendor advisory for a firmware fix.","how_to_check":"- Check the router's firmware version in its admin page; the affected version is 1.0.3.216940.\n- Check whether the router's file sharing (SMB) service is enabled and reachable from outside the home or office network.","plain_action":"If you own a Linksys EA8100 router, turn off its file sharing (SMB) feature if you can, and watch for a firmware update from Linksys.","product_name":"","needs_analyst":true,"not_affected_if":["smb-disabled","not-internet-exposed"],"who_is_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 that have the SMB file-sharing service active. The sources say the vendor did not respond to disclosure, so no patch is confirmed. Systems with the SMB service disabled or not reachable from the internet are likely not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000775,"input_tokens":4594,"output_tokens":631,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the SMB service is on by default and what anonymous access grants; check NVD and any vendor advisory for a firmware fix.","search":"'-127277':12A,15A '-2026':11A,14A '1.0.3.216940':75C 'access':41B,45B,99C 'affect':77C 'allow':48B 'anon':40B,98C 'anonym':44B 'argument':97C 'attack':9A,51B,105C,123C 'compon':89C 'contact':127C 'cve':10A,13A 'disclosur':131C 'discov':71C 'ea8100':2A,16A,17B,27B,74C 'earli':128C 'element':78C 'etc/init.d/service_smbd.sh':86C 'exploit':62B,111C 'file':32B,85C 'file-shar':31B 'firmwar':18B 'flaw':68C 'function':82C 'home':20B 'home-rout':19B 'improp':38B,102C 'infrastructur':22B 'initi':39B,103C,108C 'let':7A 'linksi':1A,23B,26B,73C 'manipul':94C 'may':46B,119C 'misconfigur':6A 'network':58B 'perform':92C 'public':61B,117C 'reach':53B 'releas':65B,114C 'remot':8A,50B,109C 'respond':135C 'result':100C 'router':3A,21B,28B 'secur':67C 'servic':5A,34B,55B,91C 'set':42B 'share':33B 'smb':4A,24B,30B,90C 'start':35B 'unknown':81C 'use':121C 'vendor':125C 'way':138C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys EA8100 routers running firmware 1.0.3.216940 that have the SMB file-sharing service active. The sources say the vendor did not respond to disclosure, so no patch is confirmed. Systems with the SMB service disabled or not reachable from the internet are likely not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a Linksys EA8100 router, turn off its file sharing (SMB) feature if you can, and watch for a firmware update from Linksys.","pkeys":["ea8100"],"ptokens":["ea8100"],"labels":["critical","ea8100","firmware","homerouter","infrastructure","linksys","smb"],"campaign_type":null,"search_a":"'-127277':12A,15A '-2026':11A,14A 'attack':9A 'cve':10A,13A 'ea8100':2A,16A 'let':7A 'linksi':1A 'misconfigur':6A 'remot':8A 'router':3A 'servic':5A 'smb':4A","search_b":"'access':41B,45B 'allow':48B 'anon':40B 'anonym':44B 'attack':51B 'ea8100':17B,27B 'exploit':62B 'file':32B 'file-shar':31B 'firmwar':18B 'home':20B 'home-rout':19B 'improp':38B 'infrastructur':22B 'initi':39B 'linksi':23B,26B 'may':46B 'network':58B 'public':61B 'reach':53B 'releas':65B 'remot':50B 'router':21B,28B 'servic':34B,55B 'set':42B 'share':33B 'smb':24B,30B 'start':35B","search_c":"'1.0.3.216940':75C 'access':99C 'affect':77C 'anon':98C 'argument':97C 'attack':105C,123C 'compon':89C 'contact':127C 'disclosur':131C 'discov':71C 'ea8100':74C 'earli':128C 'element':78C 'etc/init.d/service_smbd.sh':86C 'exploit':111C 'file':85C 'flaw':68C 'function':82C 'improp':102C 'initi':103C,108C 'linksi':73C 'manipul':94C 'may':119C 'perform':92C 'public':117C 'releas':114C 'remot':109C 'respond':135C 'result':100C 'secur':67C 'servic':91C 'smb':90C 'unknown':81C 'use':121C 'vendor':125C 'way':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127277","severity":null,"published_at":"2026-11-13T02:18:54+00:00","modified_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127277:3800","url":"https://vuldb.com/vuln/436432","severity":null,"published_at":"2026-11-13T02:44:09+00:00","modified_at":"2026-11-13T02:44:09+00:00","first_seen_at":"2026-11-13T02:44:09+00:00","fetched_at":"2026-11-13T02:44:09+00:00","note":"Only VulDB (CNA) and NVD found; no Linksys advisory or firmware fix located, vendor reportedly did not respond. VulDB says PoC public (GitHub, link not visible), no auth needed, no countermeasure known. Default-on state of SMB and what anonymous access exposes are not stated by any source. Nothing verified.","cites":["https://vuldb.com/vuln/436432"]}],"documents":[{"id":142060,"url":"https://vuldb.com/vuln/436432","title":"VulDB VDB-436432: Linksys EA8100 SMB ANON_ACCESS initialization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}