Low severity · published Oct 22, 2026
CVE-2026-114576
Linksys RE6250 Web Management strcmp random values
3.7
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
RE6250 · Linksys
1.0.04.001 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114576
github.com
https://github.com/b1uerry/cves/blob/main/Linksys/RE6250/Linksys_RE6250_predictable_sessionId/details.md
vuldb.com
https://vuldb.com/cve/CVE-2026-114576
vuldb.com
https://vuldb.com/submit/1021306
vuldb.com
https://vuldb.com/vuln/424944
vuldb.com
https://vuldb.com/vuln/424944/cti
www.linksys.com
https://www.linksys.com/
More from RE6250
9.8
CVE-2025-5447
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection
9.8
CVE-2025-5446
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkCredentialsByBBS os command injection
9.8
CVE-2025-5445
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkFWByBBS os command injection
9.8
CVE-2025-5444
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_UpgradeFWByBBS os command injection
9.8
CVE-2025-5443
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 wirelessAdvancedHidden os command injection