{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alinksysea8100/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:linksys:ea8100:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-127277"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["EA8100"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Linksys"],"content_html":"\u003cp\u003eCVE-2026-127277 describes a vulnerability in the SMB Service component of the Linksys EA8100 router, specifically within the etc/init.d/service_smbd.sh file. An attacker can remotely manipulate the ANON_ACCESS argument to trigger improper initialization. The vendor did not respond to disclosure efforts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability carries a CVSS v3.1 base score of 10.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview the configuration of the SMB Service on affected Linksys EA8100 devices.\u003c/p\u003e\n","date_modified":"2026-11-13T02:44:51Z","date_published":"2026-11-13T02:44:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-cve-2026-127277/","summary":"A critical vulnerability in the Linksys EA8100 SMB service allows remote attackers to trigger improper initialization via manipulation of the ANON_ACCESS argument.","title":"Linksys EA8100: Remote improper initialization in SMB Service (CVE-2026-127277)","url":"https://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-cve-2026-127277/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:linksys:ea8100:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-127275"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-127275\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["EA8100"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication-bypass","network"],"_cs_type":"advisory","_cs_vendors":["Linksys"],"content_html":"\u003cp\u003eThe Linksys EA8100 router, running firmware version 1.0.3.216940, contains a critical authentication bypass vulnerability in the JNAP API. The flaw exists within the 'SetRemoteSetting' and 'SetUnsecuredWiFiWarning' functions in the 'ui_server.lua' file. By manipulating the 'isEnabled' or 'enabled' arguments, an unauthenticated remote attacker can bypass security controls and modify router configurations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to gain unauthorized control over device configuration. Given the CVSS v3.1 base score of 10.0, this represents a complete loss of confidentiality, integrity, and availability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eThere is currently no vendor-provided patch available as the vendor has been unresponsive to disclosure. Organizations should restrict management access to the router to trusted internal interfaces only and disable remote management features via the web interface immediately. Inventory all EA8100 devices and monitor for unauthorized configuration change attempts targeting the JNAP API.\u003c/p\u003e\n","date_modified":"2026-11-13T09:13:25Z","date_published":"2026-11-13T00:43:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-auth-bypass-cve-2026-127275/","summary":"An authentication bypass vulnerability in the Linksys EA8100 router allows unauthenticated remote attackers to manipulate JNAP API functions and perform unauthorized configuration changes.","title":"Linksys EA8100: Authentication bypass in JNAP API (CVE-2026-127275)","url":"https://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-auth-bypass-cve-2026-127275/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:linksys:ea8100:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}