Threat database

A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.

CVE-2026-108896 is a critical OS command injection vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. It affects the setLinksysIpv6 function in the /goform/setLinksysIpv6 endpoint, where manipulation of the _6rd_prefix or _6rd_prefix_len arguments allows remote attackers to execute arbitrary OS commands. The vulnerability can be exploited remotely without user interaction and has a high CVSS 4.0 score of 9.4. The vendor was notified but has not responded or issued a patch. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-108895 is a critical OS command injection vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. The flaw exists in the setDMZ function of the /goform/setDMZ file, where manipulation of the MAC_addr argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without user interaction and has a high CVSS 4.0 score of 9.4. Public exploit code is available, but no vendor response or patch has been provided.

CVE-2026-108894 is a critical OS command injection vulnerability in the Linksys E1700 router version 1.0.0.4.003. The flaw exists in the addStaticRoute function of the Static Route Handler component, where manipulation of certain arguments can lead to remote command execution. The vulnerability allows an attacker to execute arbitrary OS commands remotely without user interaction. The exploit code has been publicly released, increasing the risk of attacks. The vendor has not responded to disclosure requests, and no patch or mitigation guidance is currently available.

CVE-2026-108893 is a critical stack-based buffer overflow vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. The flaw exists in the setVlan function within the /goform/setVlan endpoint, where improper handling of the vlan_set argument allows remote attackers to trigger a buffer overflow. Exploit code is publicly available, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.

CVE-2026-108892 is a critical stack-based buffer overflow vulnerability in the Linksys E1700 router version 1.0.0.4.003. The flaw exists in the ssid1MACFilter function of the Mac Filter component, triggered by manipulation of the newap_text_%d argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, but no vendor response or patch has been provided.

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-4558 is a high-severity OS command injection vulnerability affecting the Linksys MR9600 router firmware version 2.0.6.206937. The flaw exists in the smartConnectConfigure function within the SmartConnect.lua file, where manipulation of specific arguments (configApSsid, configApPassphrase, srpLogin, srpPassword) can lead to remote command execution. The vulnerability can be exploited without user interaction and requires low privileges, allowing an attacker to execute arbitrary OS commands remotely. Although the vendor was notified early, no response or patch has been issued, and a public exploit is available. This poses a significant risk to affected devices, potentially compromising network integrity and confidentiality. Organizations using this router model should urgently apply mitigations to prevent exploitation.

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimately run as the root user. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network  to gain access to sensitive information, including the password for admin access to the web interface and the Wi-Fi passwords.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.