CVE-2026-127275 is a missing-authentication flaw in the JNAP API of Linksys EA8100 firmware 1.0.3.216940. VulDB, the CVE numbering authority, rates it as critical. According to the disclosure, a remote attacker can change two specific settings without logging in: the router's remote management pairing state and its unsecured WiFi warning flag. A public exploit has been disclosed, and the vendor has not responded.
What Is It
The flaw is in the SetRemoteSetting and SetUnsecuredWiFiWarning functions in the router's ui_server.lua file, which is part of the JNAP API. According to the disclosure, requests that change the isEnabled or enabled arguments are processed without authentication. NVD classifies this as CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).
The researcher's write-up describes the issue as "unauthenticated write access to remote management pairing state and unsecured WiFi warning flag."
Why It Matters
VulDB rates the flaw as critical and assigns these scores:
- CVSS 3.1: 10.0 (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The vector scores the attack as network-based and low-complexity, with no privileges or user interaction needed. It also scores the scope as changed and rates the confidentiality, integrity and availability impacts all as high. The public description covers only unauthenticated writes to two settings, and the source data does not explain how that leads to the full-impact rating. - CVSS 4.0: 9.3, with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 10.0.
The NVD record says the attack can be started remotely and that the exploit "has been publicly disclosed and may be utilized." Because a public proof-of-concept exists and the disclosure says no login is needed, the barrier to exploitation appears low.
There is no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE. Active exploitation in the wild is therefore not confirmed by KEV as of this writing. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: Linksys
- Product: EA8100
- Component: JNAP API (
ui_server.lua) - Affected version: 1.0.3.216940
- CPE:
cpe:2.3:h:linksys:ea8100:*:*:*:*:*:*:*:*
The source data lists no other firmware versions.
Patch Status
No patch or vendor advisory is referenced. The NVD description says Linksys "was contacted early about this disclosure but did not respond in any way." There is no CISA KEV entry, so no CISA remediation requirement or due date applies.
Owners of EA8100 devices running firmware 1.0.3.216940 should watch Linksys for a firmware update. Until one is released, they should treat the JNAP API as reachable without authentication when deciding how much network exposure the device has.