Vulnerability in Linksys E8450

[ Why it matters ]Priority signals

• Critical severity: CVSS 10.0

[ Description ]Official description

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4276

  Linksys Router: Vulnerability allows gaining administrator rights Translated from German

  CVE-2026-120283

[ References ]References

• vuldb.com/cve/CVE-2026-120283
• vuldb.com/submit/1014924
• vuldb.com/vuln/429627
• vuldb.com/vuln/429627/cti
• www.linksys.com