CVE-2026-4558
OS Command Injection in Linksys MR9600 SmartConnect.lua Remote Exploit
Publication date: 2026-03-22
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linksys | mr9600_firmware | 2.0.6.206937 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4558 is a command injection vulnerability found in the Linksys MR9600 router, specifically in the smartConnectConfigure function of the SmartConnect.lua file. This flaw allows an attacker to manipulate certain arguments such as configApSsid, configApPassphrase, srpLogin, or srpPassword to inject and execute arbitrary operating system commands remotely.
The vulnerability can be exploited remotely without user interaction, potentially allowing an attacker to execute commands on the router with elevated privileges.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized remote code execution on the affected router. An attacker exploiting this flaw could gain control over the device, potentially leading to network compromise, interception or manipulation of network traffic, and disruption of network services.
Since the exploit is publicly available, the risk of attacks is increased, especially if the device is exposed to untrusted networks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "Detection of this vulnerability involves analyzing the Linksys MR9600 router's SmartConnectConfigure interface for signs of command injection attempts. Since the vulnerability is in the manipulation of arguments such as configApSsid, configApPassphrase, srpLogin, and srpPassword, monitoring network traffic or web requests targeting these parameters may help identify exploitation attempts."}, {'type': 'paragraph', 'content': 'A practical approach is to emulate the vulnerable firmware environment using the QEMU-based setup described in the analysis report. This allows safe testing and detection of the vulnerability by reproducing the conditions under which the command injection occurs.'}, {'type': 'paragraph', 'content': "Specific commands are not directly provided in the resources, but the report details the use of QEMU virtualization to run the vulnerable firmware and monitor the SmartConnectConfigure function. Network scanning tools or web application scanners could be configured to send crafted requests to the router's web interface targeting the vulnerable parameters."}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps are not explicitly detailed in the provided resources. However, general best practices include restricting remote access to the router's management interface, especially the SmartConnectConfigure function, to trusted networks or IP addresses."}, {'type': 'paragraph', 'content': 'Since the vendor has not responded to the disclosure, applying network-level protections such as firewall rules to block suspicious traffic targeting the vulnerable parameters can help reduce risk.'}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unusual activity or command injection attempts and considering replacement or firmware updates when available are recommended.'}] [1]