Path Traversal Vulnerability in Linksys MR9600 and MX4200

CVE-2026-25603

What is CVE-2026-25603?

A path traversal vulnerability in Linksys MR9600 and MX4200 routers allows for improper limitation of a pathname to a restricted directory. This flaw results in the possibility to mount the contents of a USB drive partition at arbitrary locations within the file system. Consequently, this could lead to the execution of shell scripts with escalated privileges, posing a significant security risk for users. It is essential for owners of these devices to implement the necessary updates to mitigate this vulnerability.

References