Linksys E8450: Stack-based buffer overflow in portal.cgi (CVE-2026-120283)
A stack-based buffer overflow vulnerability has been identified in the Linksys E8450 (firmware 1.2.00.360516) within the hidden_timezone argument of /www/cgi-bin/portal.cgi.
CVE search metadata
CVE search record: CVE-2026-120283. Severity: critical. CVSS: 10.0. KEV: no. Product: E8450 (1.2.00.360516). Brief: Linksys E8450: Stack-based buffer overflow in portal.cgi (CVE-2026-120283). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linksys-e8450-rce/
Triage facts
Revision 1- Applicability
- E8450 (1.2.00.360516)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 05:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability was identified in Linksys E8450 firmware version 1.2.00.360516. The issue involves the strcpy function in the file /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted regarding this disclosure but did not respond.