---
id: CVE-2026-127276
title: Linksys EA8100 Web UI cookie httponly flag
summary: >-
  A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an
  unknown function of the component Web UI. Such manipulation leads to cookie
  without 'httponly' flag. It is possible to launch the attack remotely. This
  attack …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-1004
  - CWE-732
vendor: Linksys
product: EA8100
affected:
  - EA8100 1.0.3.216940
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-13T00:40:24.372290Z'
exploitAvailable: true
published: '2026-11-13'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T00:40:37.116Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-127276'
references:
  - url: 'https://vuldb.com/vuln/436431'
    label: VDB-436431 | Linksys EA8100 Web UI cookie httponly flag
  - url: 'https://vuldb.com/vuln/436431/cti'
    label: 'VDB-436431 | CTI Indicators (IOB, IOC)'
  - url: 'https://vuldb.com/cve/CVE-2026-127276'
    label: CVE-2026-127276 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1040998'
    label: >-
      Submit #1040998 | Linksys EA8100 Router firmware 1.0.3.216940
      Insufficiently Protected Credentials
  - url: >-
      https://github.com/geo-chen/oss/blob/main/Linksys.md#finding-4-admin-credential-stored-in-a-non-httponly-cookie-admin-auth
  - url: 'https://www.linksys.com/'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-13T01:19:02.065Z'
---

## Overview

A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `EA8100 1.0.3.216940`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.