On this page (7 sections)
A critical vulnerability, tracked as CVE-2026-120283, has been published for the Linksys E8450 router running firmware 1.2.00.360516. According to the NVD record, a stack-based buffer overflow in the router's web interface can be triggered remotely. The record states the vendor was contacted early about the disclosure but did not respond in any way.
If you run this router at an office, a shop, or a home that hosts anything you care about, read on. No fixed firmware is identified in the NVD record, so the practical work is reducing exposure while you wait for the vendor.
What happened
The NVD entry, published on 2026-11-02, describes a flaw in the function strcpy within the file /www/cgi-bin/portal.cgi on the Linksys E8450. Manipulating the argument hidden_timezone leads to a stack-based buffer overflow, and the entry says the attack can be executed remotely.
The only source we reviewed is the NVD record itself. It lists a VulDB entry and the Linksys website among its references, but we did not review the content of those pages. There is no vendor advisory, no firmware release note, and no third-party analysis behind this article, so treat the details as a single-source report.
Technical details in plain terms
As general background, not specific to this CVE: a stack-based buffer overflow happens when a program copies input into a fixed-size memory area without checking its length, so extra data spills into neighboring memory. The C function strcpy is a well-known source of this problem because it does not limit how much it copies. Depending on device protections, the effects of such bugs can range from a crash of the affected service to loss of control over the program.
The NVD record does not say which outcome applies to the E8450, and we are not going to guess. What it does state is that the vulnerable input is the hidden_timezone argument handled by portal.cgi, and that the issue is reachable remotely.
Who is affected
Only the Linksys E8450 on firmware 1.2.00.360516 is named. The record does not say whether other firmware versions or other Linksys models are affected, so do not treat them as safe or unsafe on this evidence alone. Compare your running version to the one in the record.
Realistic exposure depends on who can reach the router's web interface. A router whose management page is open to the internet is at greater risk than one reachable only from the local network. Even a local-only page matters if untrusted devices, guests, or compromised laptops share the network.
How to check your exposure
- Log in to the router's admin page from inside your network and note the model and the firmware version. Compare it with 1.2.00.360516.
- Check whether remote management (administration from the internet) is turned on in the router settings. If it is, turn it off unless you truly need it.
- From a device outside your network, such as a phone on mobile data, test whether the router's admin address responds on your public IP. If it does, the interface is exposed.
- Review which devices and guests can reach the router's admin page on the local network.
The free SSL checker and security headers checker cover websites, not router firmware, so they will not tell you whether this flaw is present. Use the router's own admin page for the version check.
What to do now
Because no fixed firmware is identified, the goal is to shrink the attack surface and be ready to update as soon as the vendor publishes a fix.
0 of 8 done
If the router sits in front of a website or store, a compromised router can expose traffic on your network. Separate the machines that manage your site from general office or guest devices, and see our guide on small business website security for broader steps.
Detection and monitoring
The NVD record provides no indicators of compromise, so there is nothing specific to search for. Focus on general signs that a router changed: DNS settings you did not set, unfamiliar port forwards, new admin accounts, or unexpected reboots. If you suspect a compromise, a factory reset followed by reconfiguration from a clean device, and a firmware update when available, is a sensible response. Our guide on what to do after a website is hacked covers wider cleanup.
For the websites behind your connection, Webforta Monitor can alert you to uptime, certificate, DNS, and header changes, which helps you notice unexpected changes quickly. It does not assess or protect router firmware.
What is still unknown
- Whether the vendor will release a patched firmware, and when.
- Whether the flaw needs authentication to reach.
- Whether any exploitation is occurring. None is reported in the NVD record, and the CVE data shows no CISA KEV entry, which is not proof that none exists.
- Whether other Linksys models or firmware versions share the same code.
We will treat any of those as unconfirmed until a vendor advisory or independent research states them.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.