Which versions of Linksys MR9600 are affected by CVE-2026-6992?

CVE-2026-6992 is a command injection vulnerability in Linksys MR9600 router firmware that allows authenticated administrators to execute arbitrary system commands and gain full control of the device.

How to fix or mitigate CVE-2026-6992?

Within 24 hours: Identify all Linksys MR9600 routers in production (prioritize internet-facing and remote access devices); verify current firmware version against 2.0.6.206937 and document findings. Within 7 days: Restrict administrative access to MR9600 devices to a minimal trusted group; disable remote management features if not operationally required; implement network segmentation to isolate router management traffic. Within 30 days: Contact Linksys support for patch timeline and interim guidance; evaluate replacement hardware if patch is not released within 90 days; implement administrative credential monitoring for any accounts with router access.

Linksys MR9600 CVE-2026-6992

Q: What is the CVSS score of CVE-2026-6992?

CVE-2026-6992 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25668 HIGH

Command Injection (CWE-77)

2026-04-25 cna@vuldb.com

Linksys Command Injection

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 25, 2026 - 18:30 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 18:22 euvd

EUVD-2026-25668

Analysis Generated

Apr 25, 2026 - 18:22 vuln.today

CVE Published

Apr 25, 2026 - 18:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh of the component JNAP Action Handler. The manipulation of the argument pin leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

OS command injection in Linksys MR9600 router firmware 2.0.6.206937 allows authenticated administrators to execute arbitrary system commands via crafted 'pin' parameter to the BTRequestGetSmartConnectStatus JNAP action handler. Publicly available exploit code exists (CVSS E:P), enabling remote compromise of router with full system-level access. Vendor notified but unresponsive, leaving users without confirmed patch. EPSS data not available; CVSS 7.3 severity reflects high impact limited by high privilege requirement (PR:H).

Technical ContextAI

The vulnerability resides in the JNAP (Linksys JSON Network API Protocol) Action Handler implementation, specifically the BTRequestGetSmartConnectStatus function within /etc/init.d/run_central2.sh. JNAP is Linksys's proprietary API for router management. CWE-77 (OS Command Injection) indicates improper neutralization of special elements in shell commands. The 'pin' parameter is passed unsanitized to a shell interpreter, allowing injection of arbitrary commands. This affects embedded Linux routers where init scripts run with root privileges, making successful exploitation highly impactful. The MR9600 is a Wi-Fi 6 mesh router marketed for smart home environments, typically running OpenWrt-based firmware.

RemediationAI

No vendor-released patch identified at time of analysis - Linksys was notified during coordinated disclosure but did not respond. Until official firmware update is available, implement these specific compensating controls: (1) Restrict administrative interface access to trusted internal networks only via router firewall rules, blocking external WAN access to management ports (typically TCP 8080/8443 for JNAP); side effect is loss of remote management capability. (2) Change default administrative credentials to complex passwords (20+ characters) and enable account lockout if available; reduces credential compromise risk but doesn't prevent exploitation post-authentication. (3) Monitor router logs for BTRequestGetSmartConnectStatus API calls with unusual 'pin' parameter values containing shell metacharacters (semicolons, pipes, backticks); detection-only control requiring manual log review. (4) Consider replacing device with actively maintained alternative if vendor continues non-responsiveness beyond 90 days. Exploit details available at https://github.com/utmost3/cve/issues/2 and https://vuldb.com/vuln/359544 - review for IOC development.