Vulnerability · Published Mar 22, 2026 · Assigned by VulDB

CVE-2026-4558Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection

High 8.8

In plain English

A high-severity OS command injection in MR9600 from Linksys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)5.0%top 7.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Linksys	MR9600	2.0.6.206937

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-352385 | Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection vdb-entry, technical-description
VDB-352385 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #775036 | Linksys MR9600 firmware 2.0.6.206937 OS Command Injection third-party-advisory
https://github.com/utmost3/cve/issues/1 exploit, issue-tracking
https://www.linksys.com/ product