CVE-2026-127276Low· 3.7▾ TwilightPoC available

Linksys EA8100 Web UI cookie httponly flag

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score32/ 100 · Low

impact 20.4 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Nov 13, 2026

Updated

Nov 13, 2026

CVSS

3.7

Vendor

Linksys

Product

EA8100

CWE

CWE-1004, CWE-732

Depth score

32 · Low

EPSS

—

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

CISA SSVC

decided 2026-11-13

Exploitation: poc
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Linksys CWE-1004 CWE-732 #cve.org #exploit-available

Affected

EA8100 1.0.3.216940

Full technical detail▾

Overview

A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

EA8100 1.0.3.216940

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available