CVE-2026-25603

Path Traversal vulnerability in Linksys MR9600, Linksys MX4200

State: Published
Severity: 6.6 Medium
Published: Feb 24, 2026
Updated: Feb 24, 2026
Reserved: Feb 3, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
MR9600Linksys	1.0.4.205530Affected
MX4200Linksys	1.0.13.210200Affected

References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-001.txt

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.