CVE-2026-127275: Linksys EA8100 JNAP API ui_server.lua SetUnsecuredWiFiWarning missing authentication
A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file uiserver.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Linksys EA8100 devices running firmware version 1.0.3.216940 are identified as affected. The vulnerable functionality is in the JNAP API component's ui_server.lua file.
What does an attacker need to exploit it?
The attack can be initiated remotely and requires no privileges or user interaction. Public exploit disclosure is reported, so exploitation may be practical for reachable affected devices.
What functionality can be accessed without authentication?
The affected JNAP API functions are SetRemoteSetting and SetUnsecuredWiFiWarning. Manipulating the isEnabled or enabled argument triggers the missing-authentication condition.
Is a vendor fix available?
The provided information does not identify a fix. It states that the vendor was contacted before disclosure but did not respond.