CVE-2026-127273: Linksys EA8100 JNAP API IsAdminPasswordDefault missing authentication
A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which device and firmware version are known to be affected?
The affected product identified in the available data is the Linksys EA8100 running firmware version 1.0.3.216940. No other models or versions are specified.
Can this be exploited remotely without credentials?
Yes. The issue is remotely exploitable and affects JNAP API functions that are missing authentication. The supplied vector indicates no privileges are required, although user interaction is required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Is a vendor fix available?
The available data does not identify a fix. It states that the vendor was contacted before disclosure but did not respond.