Linksys MR9600 EUVD-2026-25668

Requires valid administrative credentials for the Linksys MR9600 web interface or JNAP API (PR:H). Network access to the router's management interface is required (AV:N), which may be accessible from WAN if remote management is enabled in router settings, or from LAN for attackers already present on local network. Specific vulnerable component is the BTRequestGetSmartConnectStatus JNAP action, which must be accessible in the deployed firmware version (confirmed in 2.0.6.206937). No user interaction required beyond attacker authentication (UI:N). Default configurations expose JNAP interface on LAN, limiting exploitation to already-networked attackers unless remote management features are explicitly enabled. Exploitation limited by: authentication requirement eliminates mass-scanning campaigns, vendor-specific JNAP protocol requires attacker familiarity with Linksys API structure.

Real-world risk is MODERATE despite 7.3 CVSS score. Attack requires authenticated administrative access (PR:H), significantly constraining attack surface compared to unauthenticated vulnerabilities. However, publicly available exploit code (E:P confirmed in CVSS vector) lowers exploitation barrier for attackers who compromise admin credentials through phishing, credential stuffing, or default password reuse. Network attack vector (AV:N) with low complexity (AC:L) means exploitation is straightforward once authentication hurdle is cleared. No CISA KEV listing indicates no confirmed widespread exploitation, but vendor non-responsiveness creates persistent exposure window. Primary threat scenarios: lateral movement after initial network compromise, malicious insiders, or attackers pivoting from compromised admin workstations. SSVC assessment: exploitation status is POC (not active), automatable (yes, with credentials), technical impact is total system compromise. Missing data: EPSS probability, patch timeline, affected firmware version range beyond 2.0.6.206937. Priority depends heavily on credential hygiene practices and network segmentation.

Attacker obtains Linksys MR9600 administrator credentials through password reuse or phishing campaign targeting home network users. Using publicly available exploit code from GitHub (https://github.com/utmost3/cve/issues/2), attacker sends crafted JNAP API request to BTRequestGetSmartConnectStatus endpoint with malicious shell commands embedded in 'pin' parameter, such as reverse shell payload. Router executes injected commands with root privileges, granting attacker full control over device to intercept traffic, pivot to LAN devices, or establish persistent backdoor in home network infrastructure.