CVE-2026-4558
Published: 22 March 2026
Summary
CVE-2026-4558 is a high-severity Command Injection (CWE-77) vulnerability in Linksys Mr9600 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4558 is an OS command injection vulnerability in the smartConnectConfigure function within the SmartConnect.lua file of the Linksys MR9600 router running firmware version 2.0.6.206937. The flaw arises from improper handling of the arguments configApSsid, configApPassphrase, srpLogin, and srpPassword, allowing malicious input to execute arbitrary operating system commands. It is classified under CWE-77 (Command Injection) and CWE-78 (OS Command Injection), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges (PR:L), such as authenticated users on the device, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling full system compromise such as executing arbitrary commands, potentially leading to router takeover, data theft, or further network pivoting.
Advisories from VulDB (ctiid.352385, id.352385, submit.775036) and a GitHub issue (utmost3/cve/issues/1) detail the vulnerability and confirm that a public exploit is available for use. The vendor, Linksys, was notified early but has not responded or issued any patches, leaving affected devices unmitigated as per available references.
Notable context includes the published exploit, which increases the risk of real-world attacks against unpatched Linksys MR9600 routers on this firmware version. No evidence of widespread exploitation in the wild is reported in the provided data.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14333
Vulnerability details
A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has…
more
been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability directly enables arbitrary command execution via Unix Shell (T1059.004) on the router's underlying OS and exploitation of the remote management service (T1210).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating and sanitizing untrusted inputs such as configApSsid, configApPassphrase, srpLogin, and srpPassword before processing in SmartConnect.lua.
Remediates the specific command injection flaw in the Linksys MR9600 firmware version 2.0.6.206937 by identifying, reporting, and applying patches or fixes promptly.
Detects the CVE-2026-4558 vulnerability through regular scanning of the router firmware and hosted applications, enabling timely remediation to block exploitation.