CVE-2026-127276
Deferred Deferred - Pending Action

Cookie Without 'HttpOnly' Flag in Linksys EA8100 Web UI

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulDB

Description
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127276
EUVD
EUVD-2026-124809

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys EA8100 1.0.3.216940

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1004 The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Linksys EA8100 router where the Web UI component lacks the 'httponly' flag for cookies. This means cookies used by the router's web interface can be accessed by client-side scripts, potentially exposing sensitive session data. The attack is remote and has high complexity but is difficult to exploit. A public exploit exists, and the vendor did not respond to disclosure attempts.

Detection Guidance

This CVE specifically describes a cookie without the 'httponly' flag in Linksys EA8100 firmware. To detect this, inspect HTTP responses from the router's Web UI for cookies lacking the 'HttpOnly' attribute. Use browser developer tools or tools like curl to check response headers for 'Set-Cookie' fields without 'HttpOnly'.

Impact Analysis

An attacker could exploit this to steal session cookies from the router's Web UI, potentially gaining unauthorized access to the router's admin interface. This could allow them to change settings, monitor network traffic, or launch further attacks on connected devices.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by exposing sensitive session data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Failure to address this could result in compliance violations and potential legal consequences.

Mitigation Strategies

Immediately disable remote administration access to the router's Web UI to prevent remote exploitation. Ensure all JNAP actions (GetWANStatus, GetWANStatus3, IsAdminPasswordDefault, CheckAdminPassword) are protected with authentication. Implement rate limiting for admin login attempts and validate Host headers to prevent DNS rebinding attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...