Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120283updated 2 Nov 2026, 05:42 UTC

Linksys E8450 router can be taken over remotely via crafted timezone input

Someone on your network, or anyone who can reach the router's web interface, could send a specially crafted request and take control of the router. A router takeover can expose all traffic passing through it.

No fix yetOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted hidden_timezone value to portal.cgi
  2. 2Request reaches routerWeb interface accepts the input remotely
  3. 3Buffer overflowsstrcpy copies more data than the stack holds
  4. 4Router code runs attacker inputStack corruption can redirect execution
  5. ResultAttacker may control the router

What happened

A stack-based buffer overflow in the strcpy call in /www/cgi-bin/portal.cgi of Linksys E8450 firmware 1.2.00.360516 is triggered by an oversized hidden_timezone argument, and it can be exploited remotely.

Why it is dangerous: Successful exploitation can let an attacker run code on the router, which can compromise home or small-office networks and the devices on them. Anyone running this firmware version with a reachable admin interface is at risk.

Are you affected?

You are affected if you run Linksys E8450 with firmware 1.2.00.360516 and its web interface (portal.cgi) is reachable by untrusted users.

Linksys E8450, firmware 1.2.00.360516

What to do

  1. Check whether your router runs firmware 1.2.00.360516 and look for a newer update from Linksys
  2. Do not expose the router's web admin interface to the internet, and disable remote management
  3. Limit access to the router's admin page to trusted devices on your local network

Timeline

  1. 2 Nov 2026, 01:17 UTC
    Publicly disclosed
  2. 2 Nov 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 01:19 UTC
    Picked up by Zero Radar
  4. 2 Nov 2026, 05:42 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120283 · GHSA-q5j7-qf5p-p6hv
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 01:17 UTC
On Zero Radar
2 Nov 2026, 01:19 UTC (2 min after disclosure)
Last change
2 Nov 2026, 05:42 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Linksys E8450 router can be taken over remotely via crafted timezone input · Zero Radar