PT-2026-27013 · Linksys · Linksys Mr9600

Vuldb + 1 · Publicado 2026-03-22 · Atualizado 2026-03-23 · CVE-2026-4558

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys MR9600 version 2.0.6.206937

Description A flaw exists in the Linksys MR9600 firmware. The smartConnectConfigure function within the SmartConnect.lua file is susceptible to operating system command injection. Manipulation of the arguments configApSsid, configApPassphrase, srpLogin, and srpPassword can lead to unauthorized command execution. The issue is remotely exploitable. Reports indicate the exploit has been published and is potentially being used in attacks. The vendor was notified but did not respond.

Recommendations Linksys MR9600 version 2.0.6.206937: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2026-4558

Produtos afetados

Linksys Mr9600

Referências · 15

• 🔥 https://github.com/utmost3/cve/issues/1 · Exploit
• https://vuldb.com/?submit.775036 · Nota
• https://twitter.com/RedPacketSec/status/2035957485547233573 · Publicação no Twitter
• https://reddit.com/r/pwnhub/comments/1s187su/critical_command_injection_flaw_discovered_in · Publicação no Reddit
• https://linksys.com · Nota
• https://twitter.com/CVEnew/status/2035992495067168888 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2035796708731347293 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2035774143996613118 · Publicação no Twitter
• https://vuldb.com/?ctiid.352385 · Nota
• https://vuldb.com/?id.352385 · Nota
• https://twitter.com/TheHackerWire/status/2035809475194749312 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2035805146773336544 · Publicação no Twitter
• https://twitter.com/vuldb/status/2035798313656857064 · Publicação no Twitter
• https://twitter.com/vuldb/status/2035630349234196908 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4558 · Nota de Segurança