Linksys E8450, CVE-2026-120283: a new CVE scored 10

The bottom line

Anyone running a Linksys E8450 on firmware 1.2.00.360516 should act now; the record scores this at 10 out of 10 under CVSS 4.0 and no patch exists. The vendor did not respond to disclosure, so check immediately whether the router's management interface is reachable from outside your network.

Free analysis report · 8 pagesLinksys E8450, CVE-2026-120283: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

A remotely exploitable stack-based buffer overflow in the router's portal.cgi handler. An attacker can send a crafted value for the hidden_timezone argument to overflow a stack buffer, which the record says can be done from across a network.

Why it matters

The record scores this at 10 under CVSS 4.0, the maximum possible. A stack-based buffer overflow via a remotely supplied CGI argument means an attacker who can reach the endpoint may overwrite the call stack and run code on the device. Our reading is that a router at the network edge is a high-value target: control of it gives an attacker a position inside the boundary before internal defences can act. The record states the vendor did not respond to the researcher's disclosure, so no official patch exists and no timeline for one is known.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• A score of 10 means this is already being exploited. The score reflects severity if exploited, not confirmed exploitation. The record states this is a new CVE and it is not on CISA's list of exploited vulnerabilities.
• If my firmware version differs, I am safe. The record identifies 1.2.00.360516 as the tested version. It does not say other versions are unaffected; it only names the one that was confirmed.

How we would triage it

This is our judgement.

Step 1: Find which E8450 devices you run and their firmware version

• Log in to each Linksys E8450 admin interface; the firmware version is shown on the status or administration page.
• Record whether the version matches 1.2.00.360516 as named in the record.

Step 2: Restrict access to the management interface

• Disable remote management if it is enabled, so the admin interface is not reachable from outside the local network.
• Confirm no firewall rule or port forward exposes the router's management interface to the internet.

Step 3: Watch for a vendor patch

• The record states the vendor did not respond to disclosure; check Linksys support pages for firmware updates for the E8450.
• Apply any update that addresses CVE-2026-120283 as soon as one is available.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

We are reviewing CVE-2026-120283, a remotely exploitable stack-based buffer overflow in Linksys E8450 firmware version 1.2.00.360516, scored at 10 out of 10 under CVSS 4.0. No patch has been published and the vendor did not respond to the original disclosure. Please confirm whether we run any Linksys E8450 devices, which firmware version each is on, and whether the management interface is accessible from outside our network. As no fixed version is currently available, please advise when a patch is released and confirm what steps have been taken to restrict access in the meantime. We would like written confirmation of the version and steps taken by 9 November 2026.

The weakness behind it

The record classes this as CWE-121 and CWE-119.

The sources, in their words

The CVE record:

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Versions of Linksys E8450 the record lists as affected:

• 1.2.00.360516

What we do not know yet

• Whether authentication is required before the hidden_timezone argument is processed.
• Whether the vendor has acknowledged the vulnerability or intends to release a patch.
• Whether firmware versions other than 1.2.00.360516 are also affected.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 2 November 2026. We read the vendor pages listed under Sources; nothing here has been tested.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.