CVE-2026-27849criticalCWE-78

CVE-2026-27849: critical vulnerability in Linksys MR9600

Missing neutralization in Linksys MR9600, Linksys MX4200

Published · Updated

Follow this CVE+ Monitor MR9600+ Monitor MX4200

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.4%
Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Linksys · MR9600Linksys · MX4200
Related CVEs — Linksys MR9600

In the same product, most dangerous first.

CVE-2026-6992HIGHLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionEPSS 8.1%CVE-2026-4558HIGHLinksys MR9600 SmartConnect.lua smartConnectConfigure os command injectionEPSS 5.0%CVE-2026-27848CRITICALMissing neutralization in Linksys MR9600, Linksys MX4200EPSS 0.4%CVE-2026-27847CRITICALMissing authentication in Linksys MR9600, Linksys MX4200EPSS 0.4%CVE-2026-25603MEDIUMPath Traversal vulnerability in Linksys MR9600, Linksys MX4200EPSS 0.3%CVE-2026-27850HIGHImproper verification in Linksys MR9600, Linksys MX4200EPSS 0.3%