CVE-2026-27849

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Vulnerability Details

Published Date

February 25, 2026

Last Modified

February 27, 2026

CWE ID

CWE-78

Source

NVD

Vendor

Linksys

Product

MR9600, MX4200

External References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment