CVE-2026-27848: MR9600/MX4200 RCE Vulnerability

CVE-2026-27848 Overview

CVE-2026-27848 is an OS command injection vulnerability [CWE-78] affecting Linksys MR9600 and MX4200 routers. The flaw stems from missing neutralization of special elements during the handshake of a Transport Layer Security with Secure Remote Password (TLS-SRP) connection. Attackers can inject operating system commands that the device executes as the root user. The vulnerability is reachable over the network without authentication or user interaction. SySS GmbH published the technical details in security advisory SYSS-2025-010.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands as root on affected Linksys routers by manipulating the TLS-SRP handshake.

Affected Products

Linksys MR9600 firmware version 1.0.4.205530
Linksys MX4200 firmware version 1.0.13.210200

Discovery Timeline

2026-02-25 - CVE-2026-27848 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-27848

Vulnerability Analysis

The vulnerability resides in the TLS-SRP handshake processing logic of the affected Linksys router firmware. TLS-SRP is an extension to TLS that uses the Secure Remote Password protocol for password-based mutual authentication during the handshake. The router accepts a client-supplied identifier as part of this handshake and passes it into an OS command without sanitization.

Because the input flows into a shell context without escaping or argument separation, an attacker can append shell metacharacters and additional commands. The resulting process inherits the privileges of the parent daemon, which runs as root. This combination of pre-authentication network reachability and root-level execution yields full device compromise.

Successful exploitation allows the attacker to read or modify router configuration, intercept traffic, pivot into the internal network, install persistent implants, or brick the device. See the SySS Security Advisory SYSS-2025-010 for protocol-level details.

Root Cause

The firmware fails to neutralize special elements used in an OS command [CWE-78]. Specifically, fields parsed from the TLS-SRP handshake are concatenated into a shell command line, allowing metacharacters such as backticks, semicolons, and $() substitution to terminate the intended command and introduce attacker-controlled payloads.

Attack Vector

The attack is delivered over the network by initiating a TLS-SRP connection to the affected service exposed by the router and providing a crafted SRP identifier or related handshake field containing shell metacharacters. No credentials and no user interaction are required. The injected commands execute under the root account, granting complete control of the device.

No verified proof-of-concept code is published in the available references. Refer to the SySS advisory for protocol-level reproduction guidance.

Detection Methods for CVE-2026-27848

Indicators of Compromise

Unexpected outbound connections from the router to unknown hosts following inbound TLS-SRP handshake attempts.
New or modified processes running as root on the device, particularly shells or download utilities such as wget, curl, or nc.
Configuration changes, new firewall rules, or DNS resolver modifications that were not initiated by an administrator.
Anomalous TLS handshakes that include shell metacharacters (`, ;, |, $() inside SRP identifier fields.

Detection Strategies

Inspect network traffic destined for router management services for TLS-SRP ClientHello messages containing non-printable or shell metacharacter sequences in identity fields.
Correlate router log entries showing TLS-SRP handshake failures with subsequent spawning of unexpected child processes.
Baseline normal administrative traffic to the router and alert on TLS-SRP usage from untrusted source networks, including WAN-side connections.

Monitoring Recommendations

Forward router syslog and authentication events to a centralized log platform and alert on root-owned process creation events.
Monitor for firmware version strings matching 1.0.4.205530 (MR9600) and 1.0.13.210200 (MX4200) across the asset inventory.
Watch upstream network sensors for connections originating from router IP addresses to non-ISP, non-management infrastructure.

How to Mitigate CVE-2026-27848

Immediate Actions Required

Disable WAN-side management and any externally reachable TLS-SRP service on affected Linksys MR9600 and MX4200 devices.
Restrict management access to a dedicated administrative VLAN and trusted source addresses only.
Audit router configuration, firewall rules, and DNS settings for unauthorized changes that may indicate prior exploitation.
Replace devices that no longer receive vendor security updates with currently supported hardware.

Patch Information

No vendor patch is referenced in the available CVE data at the time of publication. Consult Linksys support channels and the SySS Security Advisory SYSS-2025-010 for the latest remediation status. Apply firmware updates as soon as the vendor releases a fixed version that supersedes 1.0.4.205530 (MR9600) and 1.0.13.210200 (MX4200).

Workarounds

Block inbound connections to the router management service from untrusted networks at an upstream firewall.
Disable remote administration features that rely on TLS-SRP until a patched firmware is installed.
Segment the router from sensitive internal networks to limit lateral movement if the device is compromised.

bash

# Example upstream firewall rule to block WAN access to router management
# Adjust ROUTER_WAN_IP and MGMT_PORT to match the environment
iptables -A FORWARD -d ROUTER_WAN_IP -p tcp --dport MGMT_PORT -j DROP