Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
References
| Link | Resource |
|---|---|
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-001.txt | Exploit Third Party Advisory |
Configurations
History
26 Feb 2026, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linksys mr9600 Firmware
Linksys mx4200 Linksys Linksys mx4200 Firmware Linksys mr9600 |
|
| References | () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-001.txt - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:o:linksys:mx4200_firmware:1.0.4.205530:*:*:*:*:*:*:* cpe:2.3:o:linksys:mr9600_firmware:1.0.4.205530:*:*:*:*:*:*:* cpe:2.3:h:linksys:mr9600:-:*:*:*:*:*:*:* cpe:2.3:h:linksys:mx4200:-:*:*:*:*:*:*:* |
24 Feb 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.6 |
24 Feb 2026, 18:29
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-24 18:29
Updated : 2026-02-26 18:10
NVD link : CVE-2026-25603
Mitre link : CVE-2026-25603
CVE.ORG link : CVE-2026-25603
JSON object : View
Products Affected
linksys
- mx4200_firmware
- mr9600_firmware
- mx4200
- mr9600
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')