CVE-2026-120283

Summary

A stack-based buffer overflow in the strcpy call within /www/cgi-bin/portal.cgi on Linksys E8450 firmware 1.2.00.360516 allows remote attackers to overwrite the stack via the hidden_timezone parameter, enabling full system compromise due to lack of memory protections.

Exploitability

Exploitation is straightforward for remote attackers as it requires only sending a malformed HTTP request with a long hidden_timezone value and no authentication or user interaction is needed.

Blast radius

Successful exploitation grants an attacker full control of the device, potentially enabling pivot to internal networks, interception of traffic, or denial of service.

Detection

Look for HTTP POST requests to /www/cgi-bin/portal.cgi with an abnormally long hidden_timezone parameter (e.g., >256 characters) in web server or reverse proxy logs; no reliable host-based indicators are described.

Prioritized remediation

Upgrade to firmware version 1.2.00.360517 or later if available; since no fixed version was confirmed by the vendor and they did not respond, disable the portal.cgi endpoint or restrict access to it via firewall rules until a patch is released.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.