CVE-2026-114576
Received
Received - Intake
Insufficient Session ID Randomness in Linksys RE6250 Web Interface
Vulnerability report for CVE-2026-114576, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-22
Last updated on: 2026-10-22
Assigner: VulDB
Description
Description
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linksys | RE6250 | 1.0.04.001 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-310 | Cryptographic Issues |
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
