CVE-2026-4558

HIGH 8.8

Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection

CVSS Score

8.8

EPSS Score

0.2%

EPSS Percentile

36th

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-78 CWE-77
Vendor	linksys
Product	mr9600
Published	Mar 22, 2026
Last Updated	Mar 23, 2026

Stay Ahead of the Next One

Get instant alerts for linksys mr9600

Be the first to know when new high vulnerabilities affecting linksys mr9600 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linksys / MR9600

2.0.6.206937

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.352385 vuldb.com: https://vuldb.com/?ctiid.352385 vuldb.com: https://vuldb.com/?submit.775036 github.com: https://github.com/utmost3/cve/issues/1 linksys.com: https://www.linksys.com/

Credits

🔍 wuuu (VulDB User) VulDB