High severity · published Feb 25, 2026
CVE-2026-27850
Improper verification in Linksys MR9600, Linksys MX4200
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
MR9600 · Linksys
1.0.4.205530 · source: vendor
MX
MX4200 · Linksys
1.0.13.210200 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27850
www.syss.de
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-014.txt
More from MR9600
9.8
CVE-2026-27849
Missing neutralization in Linksys MR9600, Linksys MX4200
9.8
CVE-2026-27848
Missing neutralization in Linksys MR9600, Linksys MX4200
9.8
CVE-2026-27847
Missing authentication in Linksys MR9600, Linksys MX4200
6.6
CVE-2026-25603
Path Traversal vulnerability in Linksys MR9600, Linksys MX4200
6.2
CVE-2026-27846
Missing authentication in Linksys MR9600, Linksys MX4200