CVE-2026-120283: Critical Overflow in Linksys E8450

CVE-2026-120283 identifies a stack-based buffer overflow in the Linksys E8450 router version 1.2.00.360516. The vulnerability exists in the strcpy function of the /www/cgi-bin/portal.cgi file, where the hidden_timezone parameter lacks proper validation. The attack is remotely exploitable without authentication and directly affects device integrity.

The vulnerability achieves the maximum CVSS score of 10.0, classified as critical. The vendor was contacted early for coordinated disclosure but did not respond. No patch is available at the time of publication. Limited public awareness of the vulnerability is indicated by sparse social media signals in the past 24 hours, suggesting a narrow window for proactive defense.

IT administrators must immediately verify the Linksys E8450 version across their environments. If version 1.2.00.360516 is present, isolate the router from untrusted networks or remote access paths until an official patch is available. Monitor Linksys official channels for security updates and consider alternative solutions in the short term if the device is mission-critical.