CVE-2026-120283 is a stack-based buffer overflow in the Linksys E8450 router (firmware 1.2.00.360516), caused by an unsafe strcpy call on the hidden_timezone argument passed to the portal.cgi script. The flaw can be triggered remotely, and a working exploit is already circulating publicly. The researchers say Linksys was notified early but never responded, so no patch is currently available.
// source: nvd.nist.gov ↗