Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Linksys
  • Mr9600
  • Mx4200

No data.

No data.

References
Link Providers
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt cve-icon cve-icon
History

Fri, 27 Feb 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 26 Feb 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 26 Feb 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Linksys
Linksys mr9600
Linksys mx4200
Vendors & Products Linksys
Linksys mr9600
Linksys mx4200

Wed, 25 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Description Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Title Missing neutralization in Linksys MR9600, Linksys MX4200
Weaknesses CWE-78
References
cve-icon MITRE

Status: PUBLISHED

Assigner: ENISA

Published:

Updated: 2026-02-26T16:47:01.147Z

Reserved: 2026-02-24T07:07:48.974Z

Link: CVE-2026-27849

cve-icon Vulnrichment

Updated: 2026-02-26T16:38:25.216Z

cve-icon NVD

Status : Received

Published: 2026-02-25T17:25:40.903

Modified: 2026-02-26T17:23:02.300

Link: CVE-2026-27849

cve-icon Redhat

No data.