CVE-2026-25603mediumCWE-22

CVE-2026-25603: medium-severity vulnerability in Linksys MR9600

Path Traversal vulnerability in Linksys MR9600, Linksys MX4200

Published

Follow this CVE+ Monitor MR9600+ Monitor MX4200

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.6epss 0.3%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Linksys · MR9600Linksys · MX4200
Related CVEs — Linksys MR9600

In the same product, most dangerous first.

CVE-2026-6992HIGHLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionEPSS 8.1%CVE-2026-4558HIGHLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionEPSS 5.0%CVE-2026-27849CRITICALMissing neutralization in Linksys MR9600, Linksys MX4200EPSS 0.4%CVE-2026-27848CRITICALMissing neutralization in Linksys MR9600, Linksys MX4200EPSS 0.4%CVE-2026-27847CRITICALMissing authentication in Linksys MR9600, Linksys MX4200EPSS 0.4%CVE-2026-27850HIGHImproper verification in Linksys MR9600, Linksys MX4200EPSS 0.3%