CVE-2026-27847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27847", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "state": "PUBLISHED", "assignerShortName": "ENISA", "dateReserved": "2026-02-24T07:07:48.973Z", "datePublished": "2026-02-25T15:10:30.771Z", "dateUpdated": "2026-02-26T16:56:23.595Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "MR9600", "vendor": "Linksys", "versions": [{"status": "affected", "version": "1.0.4.205530"}]}, {"defaultStatus": "unaffected", "product": "MX4200", "vendor": "Linksys", "versions": [{"status": "affected", "version": "1.0.13.210200"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.<br><p>This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.</p>"}], "value": "Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.\nThis issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-02-25T15:10:30.771Z"}, "references": [{"tags": ["third-party-advisory", "technical-description"], "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing authentication in Linksys MR9600, Linksys MX4200", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T16:55:30.669110Z", "id": "CVE-2026-27847", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:56:23.595Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-27847", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T16:55:30.669110Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:55:42.084Z"}}], "cna": {"title": "Missing authentication in Linksys MR9600, Linksys MX4200", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Linksys", "product": "MR9600", "versions": [{"status": "affected", "version": "1.0.4.205530"}], "defaultStatus": "affected"}, {"vendor": "Linksys", "product": "MX4200", "versions": [{"status": "affected", "version": "1.0.13.210200"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt", "tags": ["third-party-advisory", "technical-description"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.\nThis issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.", "supportingMedia": [{"type": "text/html", "value": "Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.<br><p>This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-02-25T15:10:30.771Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27847", "state": "PUBLISHED", "dateUpdated": "2026-02-26T16:56:23.595Z", "dateReserved": "2026-02-24T07:07:48.973Z", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "datePublished": "2026-02-25T15:10:30.771Z", "assignerShortName": "ENISA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "MR9600", "vendor": "Linksys", "versions": [{"status": "affected", "version": "1.0.4.205530"}]}, {"defaultStatus": "unaffected", "product": "MX4200", "vendor": "Linksys", "versions": [{"status": "affected", "version": "1.0.13.210200"}]}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.\nThis issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200."}, {"lang": "es", "value": "Debido a la neutralizaci\u00f3n inadecuada de elementos especiales, se pueden inyectar sentencias SQL a trav\u00e9s del handshake de una conexi\u00f3n TLS-SRP. Esto puede ser utilizado para inyectar credenciales conocidas en la base de datos que pueden ser utilizadas para completar exitosamente el handshake y usar el servicio protegido.\nEste problema afecta a MR9600: 1.0.4.205530; MX4200: 1.0.13.210200."}], "id": "CVE-2026-27847", "lastModified": "2026-06-17T10:27:47.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27847", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T16:55:30.669110Z", "version": "2.0.3"}}]}, "published": "2026-02-25T16:23:28.833", "references": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"}], "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0.4.205530"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MR9600", "source": "cna", "vendor": "Linksys"}, "product": "mr9600", "vendor": "linksys"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0.13.210200"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MX4200", "source": "cna", "vendor": "Linksys"}, "product": "mx4200", "vendor": "linksys"}], "analysis": {"en": {"generated_at": "2026-04-17T15:14:19.086442+00:00", "value": {"mitigation_remediation": ["Upgrade the MR9600 firmware to a release later than 1.0.4.205530, and upgrade the MX4200 firmware to a release later than 1.0.13.210200, ensuring the specific vulnerability is resolved.", "Restrict remote management access to the devices by placing them behind a firewall or VPN, limiting exposure to potential attackers.", "Continuously monitor network traffic and device logs for anomalous TLS\u2011SRP handshake attempts, and alert on any suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Authentication bypass via SQL injection that allows injection of credentials into the database to complete TLS\u2011SRP handshakes and access protected services."}, "threat_synthesis": {"affected_systems": "The flaw affects Linksys MR9600 firmware 1.0.4.205530 and Linksys MX4200 firmware 1.0.13.210200. These specific versions are listed as vulnerable, and any systems running exactly these firmware builds are at risk.", "description_and_impact": "The vulnerability originates from improper neutralization of special elements during the TLS\u2011SRP handshake, allowing an attacker to inject arbitrary SQL. The injected payload can insert known credentials directly into the device\u2019s database, enabling the attacker to successfully perform the handshake and gain access to protected services. Because this bypasses the intended authentication mechanism, an attacker could potentially obtain privileged control over the device.", "risk_and_exploitability": "The CVSS score of 9.8 classifies the issue as critical, highlighting severe potential impact. However, the EPSS score of less than 1\u202f% indicates that, as of now, the likelihood of a real\u2011world exploit remains low. The vulnerability is not yet listed in CISA\u2019s KEV catalog. Exploitation requires the ability to perform a TLS\u2011SRP handshake, which typically means the device is reachable over the network. The attack surface is limited to devices configured to accept SRP connections, and no public exploitation infrastructure has been reported, further reducing immediate threat."}}}}, "created": "2026-02-26T13:15:57.147619+00:00", "updated": "2026-04-17T15:15:21.858789+00:00", "vendors": ["linksys", "linksys$PRODUCT$mr9600", "linksys$PRODUCT$mx4200"]}