Approved changes feed: RSS · Atom
cpe:2.3:a:linksys:mx4200:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Linksys (6d3f2e7c-48a8-5a19-9a98-85960b5ae3c2) |
|---|---|
| Product | Mx4200 (2f8e5f1d-5386-5c19-8b7e-8ff7ae537274) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-27850 |
vulnerable | 2026-06-08 07:55:14.058689 |
Improper verification in Linksys MR9600, Linksys MX4200
Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Published: 2026-02-25T16:58:06.450Z
Updated: 2026-02-25T19:11:29.416Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27849 |
vulnerable | 2026-06-08 07:55:14.058367 |
Missing neutralization in Linksys MR9600, Linksys MX4200
Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Published: 2026-02-25T16:20:25.395Z
Updated: 2026-02-26T16:47:01.147Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27848 |
vulnerable | 2026-06-08 07:55:14.058075 |
Missing neutralization in Linksys MR9600, Linksys MX4200
Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimately run as the root user.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Published: 2026-02-25T15:15:16.186Z
Updated: 2026-02-26T16:51:13.433Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27847 |
vulnerable | 2026-06-08 07:55:14.057544 |
Missing authentication in Linksys MR9600, Linksys MX4200
Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Published: 2026-02-25T15:10:30.771Z
Updated: 2026-02-26T16:56:23.595Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27846 |
vulnerable | 2026-06-08 07:55:14.057077 |
Missing authentication in Linksys MR9600, Linksys MX4200
Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network
to gain access to sensitive information, including the password for admin access to the web interface and the Wi-Fi passwords.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Published: 2026-02-25T15:03:58.616Z
Updated: 2026-02-25T18:36:03.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25603 |
vulnerable | 2026-06-08 07:53:20.087882 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.