What is the CVSS score of CVE-2026-27850?

CVE-2026-27850 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-27850?

Within 24 hours: Inventory all MR9600 (v1.0.4.205530) and MX4200 (v1.0.13.210200) devices and isolate affected units from production if possible; implement emergency firewall rules blocking inbound WAN traffic on port 5222. Within 7 days: Deploy network segmentation to restrict WAN-accessible services; implement monitoring and logging for suspicious port 5222 connections; conduct threat assessment for potential compromise. Within 30 days: Contact Meraki for patched firmware versions and schedule maintenance windows; perform forensic analysis of access logs for evidence of exploitation; validate all compensating controls are effective before returning to normal operations.

CVE-2026-27850

HIGH

2026-02-25 a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 18:23 nvd

HIGH 7.5

DescriptionCVE.org

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

AnalysisAI

Misconfigured firewall rules in Meraki MR9600 (1.0.4.205530) and MX4200 (1.0.13.210200) routers accept WAN connections on source port 5222, allowing unauthenticated remote attackers to access services normally restricted to the local network. An attacker can leverage this to gain unauthorized access to sensitive internal services and information. No patch is currently available to remediate this vulnerability.