CVE-2026-127276: Linksys EA8100 Web UI cookie httponly flag
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What systems are known to be affected?
The affected product and version identified in the available data are Linksys EA8100 firmware 1.0.3.216940. The issue is in an unspecified Web UI function.
Can this be exploited remotely without authentication?
The vulnerability is reported as remotely exploitable with no privileges or user interaction required. However, exploitation has high attack complexity and is considered difficult.
What is the practical impact of the missing HttpOnly flag?
The reported impact is limited to confidentiality. A cookie lacking the HttpOnly flag may be accessible to client-side script, but the available data does not describe a specific path for obtaining or executing such script.
Is public exploit code available?
Yes. The issue is flagged as having a proof of concept, and the available information states that a public exploit is available.
Is a vendor fix available?
The available data does not identify a fix or workaround. It states that the vendor was contacted before disclosure but did not respond.