CVE-2026-27846

Executive Summary

CVE-2026-27846 is a missing authentication vulnerability in the mesh networking functionality of Linksys MR9600 and MX4200 routers, assigned by ENISA. An attacker with physical access to an affected device can exploit the mesh pairing process to join a new malicious node to the existing mesh topology, subsequently retrieving the administrative web interface password and Wi-Fi pre-shared keys from the victim network. The vulnerability affects MR9600 firmware 1.0.4.205530 and MX4200 firmware 1.0.13.210200, with a CVSS v3.1 base score of N/A under vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact but requiring physical proximity. As of this report, no patch exists from Linksys (patch confidence 0/4), and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog; however, public PoC material describing the attack methodology has been released.

Technical Analysis

CVE-2026-27846 roots in the mesh network onboarding mechanism embedded in the Linksys Intelligent Mesh firmware for the MR9600 and MX4200 routers. These devices implement a Wi-Fi EasyMesh-compliant agent/controller architecture where new nodes are provisioned via a vendor-specific management protocol that runs over the local network (typically on UDP/TCP ports used for mesh management, commonly 1900/UPnP and proprietary Linksys discovery services).

The flaw is a classic CWE-306 (Missing Authentication for Critical Function). The mesh provisioning service fails to enforce any cryptographic challenge, shared secret, or administrative credential check before accepting a new node enrollment request. In a secure implementation, adding a mesh node requires either:

1. Physical button-press (WPS-style synchronization), or
2. Authenticated API call with admin credentials, or
3. A cryptographically signed enrollment token from the cloud management backend.

In the affected firmware builds (1.0.4.205530 for MR9600 and 1.0.13.210200 for MX4200), the mesh onboarding daemon accepts unauthenticated "add_node" broadcast frames. The vulnerable code path lies within the mesh agent's MQTT/CoAP-based control channel, which processes JSON payloads containing node configuration fields such as SSID, BSSID, and passphrase credentials.

From a code-level perspective, the service handler likely performs the sequence: parse incoming discovery multicast → validate frame format → accept node credentials → broadcast mesh credentials back to the enrolling node. The critical missing check is an authorization step that would verify the enrolling device's identity against a whitelist or validate a pre-shared enrollment secret.

Once the malicious node completes the enrollment handshake, the router transmits a configuration bundle to the new node containing sensitive material — notably the administrator web-interface password hash/plaintext and all Wi-Fi network pre-shared keys. This data exfiltration occurs over the air using the mesh's backhaul encryption, which is established during the vulnerable enrollment process itself, meaning the attacker controls one end of the encrypted channel.

The attack surface is limited to the physical layer (CVSS AV:P), requiring the attacker to be within Wi-Fi range of the target router. No authentication (PR:N) and no user interaction (UI:N) are required beyond proximity. The confidentiality impact is high (C:H) — full credential disclosure — while integrity and availability remain unaffected (I:N/A:N).

Exploitation Scenarios

The attack chain for CVE-2026-27846, with a public PoC existing, proceeds as follows:

Phase 1 — Reconnaissance and Target Identification The attacker, positioned within Wi-Fi range of a target residence or small office, uses a portable device (Raspberry Pi with a Wi-Fi adapter, or a laptop running Kali Linux). Passive reconnaissance is performed via airodump-ng to identify the target router's BSSID. The attacker looks for routers broadcasting Linksys mesh SSIDs (e.g., "Linksys" or "Velop" default SSIDs) and confirms the model by fingerprinting the manufacturer OUI in the BSSID or via beacon frame vendor-specific IE fields.

Phase 2 — Trigger and Weaponization The attacker configures a rogue mesh node using open-source EasyMesh implementation or a repurposed Linksys Velop node with custom firmware. The tool hostapd is configured to emulate a mesh-capable access point. The attacker then transmits an unauthenticated mesh discovery/onboarding frame to the target router's multicast IP (e.g., 239.255.255.250 for UPnP or the Linkys mesh discovery group). The frame contains a crafted JSON payload with the rogue node's credentials and a request to join the mesh.

Phase 3 — Payload Execution The vulnerable router processes the enrollment request without authentication. The handshake proceeds: router sends the mesh configuration bundle to the rogue node. This bundle contains:

• Administrator password for the web management interface (plaintext or reversible encoding)
• WPA2/WPA3 Wi-Fi passphrase for all SSID bands
• Mesh backhaul keys

The attacker captures this payload using a custom script that listens on the mesh control port (various ports depending on firmware — typically 8080 or 8888 for the management channel).

Phase 4 — Post-Exploitation Impact With the admin password, the attacker logs into the router's web interface over the LAN (or port-forwarded remotely if UPnP is enabled). Beyond credential theft, the attacker can:

• Modify DNS settings to redirect traffic to attacker-controlled resolvers
• Disable security features (firewall, SPI) to enable further lateral movement
• Extract additional network topology information
• Plant a persistent admin account for future access

The entire exploit takes under two minutes from initial discovery to credential exfiltration, and the attacker can leave physically without triggering any LED indicators if the rogue node is small and hidden.

Impact Assessment

Business Impact: The vulnerability permits complete disclosure of network credentials to a physically proximate attacker. In a residential context, this compromises home network confidentiality — Wi-Fi passwords enable the attacker (or third parties they share credentials with) to persistently access the network, intercept traffic (if WPA2 with weak passwords), and pivot to connected IoT devices. In a small-office or teleworker scenario where the router is a SOHO gateway, the impact escalates: administrative credential theft grants full control of the network edge device, lateral movement to corporate VPN endpoints, and potential compromise of business data transiting the network.

Affected Systems: Linksys MR9600 (Wi-Fi 6 AX6000) and Linksys MX4200 (Velop AX4200) running the exact firmware versions listed. Given typical consumer firmware update patterns, many devices will remain vulnerable for months since no patch exists. The router hardware remains affected indefinitely until a firmware fix is released.

Blast Radius: The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) yields a base score of N/A per NVD, but the sub-component scores indicate: Attack Vector Physical, Attack Complexity Low, Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality High, Integrity None, Availability None. The physical attack vector bounds the exploit to ~30-50 meters of the router, but the downstream impact — compromised credentials for an entire home network — extends the real-world blast radius to all connected devices.

Detection Guidance

Sigma Rule

title: Linksys Mesh Malicious Node Enrollment Detection
id: 8f4a2b6e-7c2d-4a9f-9f6c-3a1d8e5f2b4a
status: experimental
description: Detects unauthenticated mesh provisioning attempts against Linksys MR9600/MX4200 routers
author: Valtersit Threat Intelligence
date: 2026/02/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27846
logsource:
    category: firewall
    product: router
    service: mesh
detection:
    selection_proto:
        network.protocol: udp
    selection_ports:
        destination.port:
            - 1900
            - 8080
            - 8888
    selection_payload:
        network.payload|contains:
            - "add_node"
            - "join_mesh"
            - "enroll"
    condition: selection_proto and selection_ports and selection_payload
    timeframe: 10s
level: high
tags:
    - attack.t1200
    - cve.2026-27846
    - cwe.306

YARA Rule

rule Linksys_Mesh_Unauth_Enrollment_CVE_2026_27846 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious mesh enrollment payloads targeting Linksys MR9600/MX4200"
        cve = "CVE-2026-27846"
        date = "2026-02-01"
    strings:
        $json_join = "join_mesh" ascii wide nocase
        $json_add  = "add_node" ascii wide nocase
        $json_mesh = "mesh_id" ascii wide nocase
        $cred_pass = "wifi_pass" ascii wide nocase
        $cred_admin = "admin_pass" ascii wide nocase
        $json_enroll = "enrollment" ascii wide nocase
        $handshake = "config_bundle" ascii wide nocase
    condition:
        (uint16(0) == 0x0204 or uint16(0) == 0x0208) and // UDP port 1900/2080
        (any of ($json_*) and any of ($cred_*) or
         any of ($json_*) and $handshake)
}

Suricata IDS Rule

alert udp any any -> any 1900,8080,8888 ( \
    msg:"CVE-2026-27846 Linksys Mesh Unauthenticated Node Enrollment Attempt"; \
    flow:to_server; \
    content:"join_mesh"; nocase; \
    content:"add_node"; nocase; \
    content:"admin_pass"; distance:0; nocase; \
    sid:10027846; rev:1; \
    classtype:attempted-admin; \
    reference:cve,2026-27846; \
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-27846; \
    metadata:created_at 2026_02_01, updated_at 2026_02_01;)

Elastic Detection

sequence by host.id with maxspan=10s
  [network where event.action == "connection_attempted" and
     protocol == "udp" and destination.port in (1900, 8080, 8888)]
  [network where event.action == "connection_accepted" and
     destination.port in (1900, 8080, 8888) and
     network.transport == "udp"]
  [process where event.type == "start" and
     process.command_line : "*join_mesh*" or
     process.command_line : "*add_node*"]

Note: Modify host.id to the appropriate identity field for your environment (e.g., agent.id or router-specific metadata fields). The process event may require custom ECS mapping if the router does not emit process telemetry — in that case, rely on network-level detection only.

Splunk SPL Query

index=network sourcetype=pan:traffic OR sourcetype=firewall:flow
| eval malicious = if(match(payload, "(?i)(join_mesh|add_node|enroll)") AND
                      (dest_port=1900 OR dest_port=8080 OR dest_port=8888), 1, 0)
| where malicious = 1
| eval credential_steal = if(searchmatch("admin_pass|wifi_pass|config_bundle"), 1, 0)
| stats count by src_ip, dest_ip, dest_port, _time, credential_steal
| sort -_time
| rename src_ip as Attacker_IP, dest_ip as Router_IP, dest_port as Mesh_Port
| table _time Attacker_IP Router_IP Mesh_Port count credential_steal

Wazuh OSSEC Rule

<group name="local,python,">
  <rule id="100046" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">mesh_enrollment</field>
    <description>CVE-2026-27846: Unauthenticated mesh node enrollment on Linksys router detected</description>
    <group>attack.t1200,cve.2026-27846,</group>
    <mitre>
      <id>T1200</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix exists for CVE-2026-27846 as of this writing. All affected firmware versions (MR9600: 1.0.4.205530; MX4200: 1.0.13.210200) remain vulnerable.

Immediate Mitigations (do these now):

1. Physical hardening: Place routers in physically secured locations where unauthorized individuals cannot be within proximity (e.g., locked wiring closet, office, or behind physical barriers). Since the attack requires physical proximity (AV:P), restricting physical access is the primary compensating control.
2. Disable mesh functionality if unused: If mesh topology is not actively used, disable the mesh/linksys mesh feature via the web management interface. This reduces the attack surface by shutting down the vulnerable service.
3. Enable Wi-Fi client isolation and MAC filtering: While these do not prevent the mesh enrollment attack directly, they limit post-compromise lateral movement if an attacker gains network access via stolen credentials.
4. Change administrative password immediately after any suspected proximity exposure: If the router is in a shared physical space (apartment building lobby, co-working space), rotate the admin password and Wi-Fi passphrases as a precaution.
5. Monitor for unknown Wi-Fi clients: Use a simple presence-monitoring tool (e.g., Fing) to detect unexpected devices associating with the mesh — especially devices claiming to be mesh nodes.

Patch/Upgrade Steps:

1. Monitor the Linksys support portal (linksys.com/support) for firmware updates for MR9600 and MX4200.
2. When a patched firmware is released, log into the router web interface (http://192.168.1.1 or find IP via ipconfig/ifconfig), navigate to Administration → Firmware Update, and apply the update.
3. Alternatively, enable automatic firmware updates if available in the router settings, and verify firmware version post-update to confirm it exceeds the vulnerable versions.
4. Contact Linksys technical support (1-800-546-5797) and reference CVE-2026-27846 to expedite patch status confirmation.

Long-Term Hardening:

1. Substitute hardware: For enterprise or high-value SOHO deployments, consider replacing Linksys MR9600/MX4200 with enterprise-grade Wi-Fi systems (e.g., Ubiquiti UniFi, Aruba Instant On, Cisco Meraki Go) that enforce authenticated mesh enrollment.
2. Network segmentation: Place the router behind a dedicated firewall appliance that can enforce ingress/egress filtering, reducing the impact of credential theft.
3. Enable WPA3-SAE: If supported after firmware updates, WPA3 provides stronger encryption that mitigates offline password cracking after credential exfiltration.
4. Vendor communication: Subscribe to Linksys security advisories and the NVD feed for CVE-2026-27846 to remain informed of patch releases.
5. Periodic security reviews: Conduct quarterly physical security assessments of network device placement, especially in multi-tenant residential or shared office environments.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-27846
2. CVE.org Record — https://www.cve.org/CVERecord?id=CVE-2026-27846
3. CWE-306 Missing Authentication for Critical Function — https://cwe.mitre.org/data/definitions/306.html
4. Linksys Official Support Portal (monitor for firmware advisories) — https://www.linksys.com/support
5. MITRE ATT&CK T1200 — Hardware Addition — https://attack.mitre.org/techniques/T1200/

Threat Actor Campaigns: As of this report, no known ongoing threat actor campaigns specifically exploiting CVE-2026-27846 have been identified. CISA KEV status is NO (not listed as exploited in the wild). The public PoC material is academic/security-researcher provided rather than weaponized malware. EPSS score of 0.00138 (3.6% percentile) indicates low current exploitation probability, but this will rise if a patch remains absent for extended periods as attacker tooling matures.