CVE-2026-120283

Linksys E8450 portal.cgi strcpy stack-based overflow

CRITICAL 10.0

CVSS 4.0Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PPublished: 2026-11-02 01:00 UTCUpdated: 2026-11-02 14:24 UTCAssigner: VulDB

Description

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CWE

CWE-121
CWE-119

Affected

Linksys E8450

References

https://vuldb.com/vuln/429627vdb-entry, technical-description
https://vuldb.com/vuln/429627/ctisignature, permissions-required
https://vuldb.com/cve/CVE-2026-120283third-party-advisory
https://vuldb.com/submit/1014924third-party-advisory
https://www.linksys.com/product

View on CVE.org