CVE-2026-27846— Missing authentication in Linksys MR9600, Linksys MX4200
Quick assessment
Affected
Linksys MR9600
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linksys MR9600是美国Linksys公司的一款无线路由器。 Linksys MR9600 1.0.4.205530版本和Linksys MX4200 1.0.13.210200版本存在安全漏洞，该漏洞源于缺少身份验证，可能导致敏感信息泄露。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-27846
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing authentication in Linksys MR9600, Linksys MX4200
Source: CVE Program / CVE List V5
Vulnerability Description
Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network
to gain access to sensitive information, including the password for admin access to the web interface and the Wi-Fi passwords.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Linksys MR9600 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linksys MR9600是美国Linksys公司的一款无线路由器。 Linksys MR9600 1.0.4.205530版本和Linksys MX4200 1.0.13.210200版本存在安全漏洞，该漏洞源于缺少身份验证，可能导致敏感信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-27846
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27846
请登录查看更多情报信息。
Same Patch Batch · Linksys · 2026-02-25 · 5 CVEs total
| CVE-2026-27847 | Missing authentication in Linksys MR9600, Linksys MX4200 | |
| CVE-2026-27848 | Missing neutralization in Linksys MR9600, Linksys MX4200 | |
| CVE-2026-27849 | Missing neutralization in Linksys MR9600, Linksys MX4200 | |
| CVE-2026-27850 | Improper verification in Linksys MR9600, Linksys MX4200 |
IV. Related Vulnerabilities
Same product: MR9600
-
CVE-2026-6992
Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmart -
CVE-2026-4558
Linksys MR9600 SmartConnect.lua smartConnectConfigure os com -
CVE-2026-27850
Improper verification in Linksys MR9600, Linksys MX4200 -
CVE-2026-27849
Missing neutralization in Linksys MR9600, Linksys MX4200 -
CVE-2026-27848
Missing neutralization in Linksys MR9600, Linksys MX4200
Same vendor: Linksys
-
CVE-2026-108896
Linksys E1700 setLinksysIpv6 os command injection -
CVE-2026-108895
Linksys E1700 setDMZ os command injection -
CVE-2026-108894
Linksys E1700 Static Route addStaticRoute os command injecti -
CVE-2026-108893
Linksys E1700 setVlan stack-based overflow -
CVE-2026-108892
Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow
Same weakness: CWE-306
-
CVE-2026-111322
Archon 0.2.13 through 0.11.1 Missing Authentication via /api -
CVE-2026-111312
OpenHealth through 0.2.0 Missing Authentication via /api/hea -
CVE-2026-105038
EnergizeLab Eilik Unauthenticated AI Model Administration an -
CVE-2026-105034
EnergizeLab Eilik Unauthenticated Device-Token Issuance for -
CVE-2026-84731
Pre-Authentication Admin Bypass and Remote Code Execution in
V. Comments for CVE-2026-27846
No comments yet