Linksys E8450 router flaw lets unauthenticated attackers corrupt memory
CVE-2026-120283 affects firmware 1.2.00.360516 and is rated 10.0 under CVSS 3.1 by VulDB; no compromise has been confirmed.
A vulnerability in the Linksys E8450 router has been disclosed as CVE-2026-120283, allowing network attackers to trigger a stack-based buffer overflow without authentication, according to dailysecu.com.
The flaw affects firmware version 1.2.00.360516 and sits in the web management function portal.cgi, which handles the hidden_timezone setting without validating input length. Attackers with network access to the web management interface can exploit it by sending crafted requests, causing remote memory corruption.
VulDB rates the vulnerability 10.0 under CVSS 3.1 and 9.3 under CVSS 4.0. No successful remote code execution or actual compromise has been confirmed from the disclosure.
What users should do
Users are advised to limit internet exposure of the router's admin interface and to check the vendor's security advisory and patched firmware.
Quick answers
What is CVE-2026-120283?
It is a stack-based buffer overflow in the Linksys E8450 router's web management function portal.cgi, affecting firmware 1.2.00.360516. It can be triggered remotely without authentication by attackers with network access to the web management interface.
Has the vulnerability been exploited?
No successful remote code execution or actual compromise has been confirmed from this disclosure.
How can Linksys E8450 users protect their routers?
Users are advised to limit internet exposure of the router's admin interface and check the vendor's security advisory and patched firmware.