https://feed.craftedsignal.io/cpes/cpe2.3alinksysea8100/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 13 Nov 2026 02:44:51 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-cve-2026-127277/Fri, 13 Nov 2026 02:44:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-cve-2026-127277/A critical vulnerability in the Linksys EA8100 SMB service allows remote attackers to trigger improper initialization via manipulation of the ANON_ACCESS argument.CVE-2026-127277 describes a vulnerability in the SMB Service component of the Linksys EA8100 router, specifically within the etc/init.d/service_smbd.sh file. An attacker can remotely manipulate the ANON_ACCESS argument to trigger improper initialization. The vendor did not respond to disclosure efforts.

Impact

This vulnerability carries a CVSS v3.1 base score of 10.0.

Recommendation

Review the configuration of the SMB Service on affected Linksys EA8100 devices.

]]>criticaladvisoryhttps://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-auth-bypass-cve-2026-127275/Fri, 13 Nov 2026 00:43:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linksys-ea8100-auth-bypass-cve-2026-127275/An authentication bypass vulnerability in the Linksys EA8100 router allows unauthenticated remote attackers to manipulate JNAP API functions and perform unauthorized configuration changes.The Linksys EA8100 router, running firmware version 1.0.3.216940, contains a critical authentication bypass vulnerability in the JNAP API. The flaw exists within the 'SetRemoteSetting' and 'SetUnsecuredWiFiWarning' functions in the 'ui_server.lua' file. By manipulating the 'isEnabled' or 'enabled' arguments, an unauthenticated remote attacker can bypass security controls and modify router configurations.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized control over device configuration. Given the CVSS v3.1 base score of 10.0, this represents a complete loss of confidentiality, integrity, and availability.

Recommendation

There is currently no vendor-provided patch available as the vendor has been unresponsive to disclosure. Organizations should restrict management access to the router to trusted internal interfaces only and disable remote management features via the web interface immediately. Inventory all EA8100 devices and monitor for unauthorized configuration change attempts targeting the JNAP API.

]]>criticaladvisoryvulnerabilityauthentication-bypassnetwork