Two vulnerabilities have been discovered in Linksys’s EA8100 router model that can be exploited without authentication through the device’s local management interface. Security researcher geo-chen reported the issues via Bugcrowd on September 28, 2026; the findings were confirmed on the latest 1.0.3.216940 firmware. The two flaws were assigned CVE-2026-127275 and CVE-2026-127277.
Despite being reported to the vendor, no patch has been released. The model was moved to end-of-life status on October 17, 2026, meaning Linksys no longer commits to providing security updates for this device. For that reason, the researcher disclosed the findings publicly and shared the technical details in a post on GitHub.
Changing settings in the JNAP interface without logging in
CVE-2026-127275 stems from the fact that two write operations in the router’s local management API, called JNAP, do not require any authentication at all. The ui/SetRemoteSetting operation changes the device’s remote management pairing status, while the core/SetUnsecuredWiFiWarning operation changes the insecure Wi-Fi warning flag shown in the interface. The researcher confirmed that, out of 140 write operations in the management interface, these two returned a successful response instead of an error when called without authorization.
What makes the issue worse is this detail: JNAP does not validate the Host header of incoming requests. Because of this weakness, a web page prepared with the DNS rebinding technique can direct the user’s browser to the router on the local network and execute these operations. In other words, the attack can be triggered not only from a device connected to the network, but also when a user on that network opens a malicious page.
SMB anonymous access maps to the admin account
CVE-2026-127277 is a configuration flaw on the file-sharing side. The device’s service_smbd.sh script writes the security = share and guest account = admin lines to the configuration file when SMB anonymous access is enabled, and also adds the everyone:full, anonymous:full permission to every share. As a result, when USB storage sharing is opened without a password, anonymous sessions on the network are treated with the router’s administrator identity instead of a limited guest account.
Anonymous FTP access on the same device works correctly and uses a separate anonymous account. So this is not a design flaw affecting the whole device; it is an implementation choice specific to the SMB service. The researcher also clearly notes that they did not complete a proof of file leakage because no USB disk was connected to the test device; the finding is at the configuration and root-cause level.
Why are there both 10.0 and 5.3 scores?
VulDB rated both vulnerabilities as critical 10.0 under CVSS 3.1, treating them as exploitable over the network. The researcher’s own assessment is more restrained: 5.3 for the JNAP flaw and 6.5 for the SMB flaw. The reasoning is that the attack must come from within the local network or via DNS rebinding, and on the JNAP side the impact is limited to two settings flags. The gap between the two scores shows that the real risk depends on how your network is set up.
What should you do?
Do not expose the router’s management interface to the internet; JNAP and the web interface should be accessible only from the local network. If you do not use it, disable the SMB service; if you do use it, disable anonymous access. If USB storage sharing must remain enabled, at the very least do not allow guest access. If the admin password is still the default, change it, and use WPA2 or WPA3 for Wi-Fi.
Since the device is end-of-life, waiting for a patch is not realistic. For anyone still using an EA8100 on a home network, the healthiest step is to replace it with a supported model. Until then, it is worth checking the router logs for unexpected JNAP requests and SMB connections you do not recognize.
Source: NVD · geo-chen research
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.