Linksys E8450 EUVD-2026-114916

Exploitation requires network reachability to the router's HTTP management interface serving /www/cgi-bin/portal.cgi on Linksys E8450 firmware 1.2.00.360516; the attacker supplies an overlong hidden_timezone parameter to the vulnerable strcpy. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no authentication, no user interaction and no special configuration are stated as required against this build. The practical limiting factor is exposure of the web interface: routers whose management UI is confined to the LAN restrict the attack to on-network or pivoted attackers, whereas any WAN-exposed or remotely-administered unit is directly reachable. Impact is bounded to the single affected firmware version named in the source.

Multiple signals converge on high priority but with one unverified anchor. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. Exploit maturity in the vector is E:P (Proof-of-Concept), meaning a public PoC reference exists but is not verified as working exploit code; it is NOT listed in CISA KEV and no EPSS probability was supplied, so there is no evidence of confirmed active, widespread exploitation yet. A classic stack-based strcpy overflow (CWE-121) in a CGI handler on a consumer router is a well-understood, reliably exploitable pattern, which supports the act_now label despite the missing EPSS/KEV data. Tempering factors: the only sourcing is VulDB (a single reporter), the vendor did not respond to disclosure, and there is no independent vendor advisory or patch, so affected-version and fix data cannot be cross-confirmed. Net: treat as a real, actionable priority for anyone running this device, while noting that active in-the-wild exploitation is not confirmed and the technical claims rest on a single intelligence source.

A remote attacker who can reach the router's web management interface (portal.cgi) sends a crafted request with an oversized hidden_timezone argument, overflowing a fixed-size stack buffer in the strcpy call. Because no authentication or user interaction is required and attack complexity is low, successful exploitation can crash the service or achieve arbitrary code execution on the device. A public PoC reference exists (CVSS E:P); it is not verified as working exploit code.