CVE-2026-27847CWE-89

Missing authentication in Linksys MR9600, Linksys MX4200

Critical · published February 25, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.

This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00599 · 48.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-25T15:10Z
EPSS history
Timeline
  • 25 FEB 15:10Z
    Missing authentication in Linksys MR9600, Linksys MX4200
    cvelistv5