CVE-2026-127277criticalCWE-665

CVE-2026-127277: critical vulnerability in Linksys EA8100

Linksys EA8100 SMB Service service_smbd.sh initialization

Published

Follow this CVE+ Monitor EA8100

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10
A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in improper initialization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Linksys · EA8100
Related CVEs — Linksys EA8100

In the same product, most dangerous first.

CVE-2026-127276MEDIUMLinksys EA8100 Web UI cookie httponly flagEPSS —CVE-2026-127275CRITICALLinksys EA8100 JNAP API ui_server.lua SetUnsecuredWiFiWarning missing authenticationEPSS —CVE-2026-127274MEDIUMLinksys EA8100 CheckAdminPassword excessive authenticationEPSS —CVE-2026-127273MEDIUMLinksys EA8100 JNAP API IsAdminPasswordDefault missing authenticationEPSS —