Linksys EA8100: Authentication bypass in JNAP API (CVE-2026-127275)
An authentication bypass vulnerability in the Linksys EA8100 router allows unauthenticated remote attackers to manipulate JNAP API functions and perform unauthorized configuration changes.
CVE search metadata
CVE search record: CVE-2026-127275. Severity: critical. CVSS: 10.0. KEV: no. Product: EA8100. Brief: Linksys EA8100: Authentication bypass in JNAP API (CVE-2026-127275). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-auth-bypass-cve-2026-127275/
Triage facts
Revision 2- Applicability
- EA8100
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 13, 09:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
The Linksys EA8100 router, running firmware version 1.0.3.216940, contains a critical authentication bypass vulnerability in the JNAP API. The flaw exists within the 'SetRemoteSetting' and 'SetUnsecuredWiFiWarning' functions in the 'ui_server.lua' file. By manipulating the 'isEnabled' or 'enabled' arguments, an unauthenticated remote attacker can bypass security controls and modify router configurations.
Impact
Successful exploitation allows an unauthenticated remote attacker to gain unauthorized control over device configuration. Given the CVSS v3.1 base score of 10.0, this represents a complete loss of confidentiality, integrity, and availability.
Recommendation
There is currently no vendor-provided patch available as the vendor has been unresponsive to disclosure. Organizations should restrict management access to the router to trusted internal interfaces only and disable remote management features via the web interface immediately. Inventory all EA8100 devices and monitor for unauthorized configuration change attempts targeting the JNAP API.
Immediate actions
Disable remote management interfaces on Linksys EA8100 devices.
Threat Hunt
Search device management logs or web server access logs for anomalous POST requests to JNAP API endpoints containing 'SetRemoteSetting' or 'SetUnsecuredWiFiWarning'.
Data: Web server access logs, API call telemetry
Mitigations
Restrict management access to local network segments.
CVE-2026-127275