PT-2026-27013 · Linksys · Linksys Mr9600

Vuldb + 1 · Published 2026-03-22 · Updated 2026-03-23 · CVE-2026-4558

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys MR9600 version 2.0.6.206937

Description A flaw exists in the Linksys MR9600 firmware. The smartConnectConfigure function within the SmartConnect.lua file is susceptible to operating system command injection. Manipulation of the arguments configApSsid, configApPassphrase, srpLogin, and srpPassword can lead to unauthorized command execution. The issue is remotely exploitable. Reports indicate the exploit has been published and is potentially being used in attacks. The vendor was notified but did not respond.

Recommendations Linksys MR9600 version 2.0.6.206937: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-4558

Affected Products

Linksys Mr9600

References · 15

• 🔥 https://github.com/utmost3/cve/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4558 · Security Note
• https://vuldb.com/?submit.775036 · Note
• https://twitter.com/RedPacketSec/status/2035957485547233573 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1s187su/critical_command_injection_flaw_discovered_in · Reddit Post
• https://linksys.com · Note
• https://twitter.com/CVEnew/status/2035992495067168888 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035796708731347293 · Twitter Post
• https://twitter.com/CveFindCom/status/2035774143996613118 · Twitter Post
• https://vuldb.com/?ctiid.352385 · Note
• https://vuldb.com/?id.352385 · Note
• https://twitter.com/TheHackerWire/status/2035809475194749312 · Twitter Post
• https://twitter.com/cyberbivash/status/2035805146773336544 · Twitter Post
• https://twitter.com/vuldb/status/2035798313656857064 · Twitter Post
• https://twitter.com/vuldb/status/2035630349234196908 · Twitter Post