A stack-based buffer overflow in the Linksys E8450 router's portal.cgi has been reported as critical. According to the CNA-assigned scoring, it can be triggered remotely without authentication. The vendor reportedly did not respond to the disclosure, and no patch is listed.
What Is It
CVE-2026-120283 is a stack-based buffer overflow in Linksys E8450 firmware version 1.2.00.360516. According to the disclosure, the flaw is in the use of the strcpy function in /www/cgi-bin/portal.cgi. An attacker who manipulates the hidden_timezone argument may be able to overflow a stack buffer. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
VulDB, acting as the CNA, published the record. The scores and details below come from VulDB's record. This brief cites no independent NVD analysis, so the assessment has not yet been confirmed by a third party.
Why It Matters
VulDB assigned the following scores:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The CVSS vectors describe a network-based attack of low complexity that needs no privileges or user interaction. If successful, it could fully compromise confidentiality, integrity and availability, and the CVSS 3.1 scope is rated "Changed." These ratings are the CNA's assessment and have not been independently analyzed. Real-world impact may depend on how the device is configured and whether portal.cgi is reachable from the network. The CVSS 4.0 record rates exploit maturity as proof-of-concept, which suggests exploit material exists. This brief has not independently verified that material.
KEV status: CVE-2026-120283 is not in the CISA Known Exploited Vulnerabilities catalog. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: Linksys
- Product: E8450
- Affected version: 1.2.00.360516
- CPE:
cpe:2.3:o:linksys:e8450_firmware:*:*:*:*:*:*:*:*
The source data lists only firmware version 1.2.00.360516 as affected. It does not say whether other versions are affected.
Patch Status
No patch or fixed firmware version is listed. According to the disclosure, the vendor was contacted early but did not respond. There is no CISA KEV entry, so CISA has issued no required action or remediation deadline.
Organizations running the affected E8450 firmware should check the vendor site for firmware updates and follow the VulDB entries for any change in status.