# CVE-2026-127275: Linksys EA8100 authentication bypass in JNAP API

Source: https://junglewise.ai/threats/cve-2026-127275-a-vulnerability-was-determined-in-linksys-ea8100-1-0-3-216940  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-127275 · Severity: critical · CVSS 10 · Published 2026-11-13

The Linksys EA8100 router's web administration interface contains a critical flaw that allows attackers to modify remote management and WiFi security settings without providing credentials. An attacker on the network can remotely exploit this to enable unsafe configurations, potentially exposing the router's administrative functions or disabling security warnings.

Technologies: [Linksys EA8100](https://junglewise.ai/threats/technologies/ea8100). Vendors: [Linksys](https://junglewise.ai/threats/vendors/linksys).

## Quick answers

**Is CVE-2026-127275 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-127275 being exploited in the wild.

**How severe is CVE-2026-127275?** Critical severity, with a CVSS score of 10, published 13 November 2026.

**Which products and versions are affected?** Linksys EA8100 1.0.3.216940.

**Is there a fix for CVE-2026-127275?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-127275 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-127275?** Check whether you run Linksys EA8100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The JNAP API functions SetRemoteSetting and SetUnsecuredWiFiWarning in ui_server.lua fail to validate authentication before processing requests, allowing unauthenticated manipulation of the isEnabled/enabled parameters. This is a missing authentication issue in the HTTP API handler reachable over the network. An attacker can directly call these functions to alter router state without valid credentials.

## Affected products

- Linksys EA8100 1.0.3.216940

## Timeline

- 2026-11-13: disclosed: Publicly disclosed; vendor did not respond to early notification

## References

- [https://github.com/geo-chen/oss/blob/main/Linksys.md](https://github.com/geo-chen/oss/blob/main/Linksys.md)
- [https://vuldb.com/cve/CVE-2026-127275](https://vuldb.com/cve/CVE-2026-127275)

## Related threats

- [Linksys EA8100 SMB service improper initialization](https://junglewise.ai/threats/cve-2026-127277-a-security-flaw-has-been-discovered-in-linksys-ea8100-1-0-3)
- [Linksys EA8100 missing authentication in JNAP API](https://junglewise.ai/threats/cve-2026-127273-a-vulnerability-has-been-found-in-linksys-ea8100-1-0-3-216940)