CVE-2026-27847

Executive Summary

CVE-2026-27847 is a critical SQL injection vulnerability affecting the TLS-SRP (Transport Layer Security — Secure Remote Password) handshake implementation in two Linksys consumer router models: MR9600 (firmware 1.0.4.205530) and MX4200 (firmware 1.0.13.210200). The flaw allows an unauthenticated remote attacker to inject SQL statements into backend database queries during the handshake process, potentially writing attacker-controlled credentials directly into the device's authentication database. If successfully exploited, the attacker can authenticate to protected services with injected credentials and obtain full administrative control over the affected router. The vulnerability is assigned a CVSS v3.1 score of 9.4 (Critical) with a network attack vector, low attack complexity, no privileges required, and no user interaction. At the time of this report, no official patch has been released by Cisco (Linksys's parent company), and the EPSS score suggests limited but non-zero real-world exploitation activity (0.00320, 24.5th percentile).

Technical Analysis

The vulnerability resides in the SQL query construction layer that handles TLS-SRP handshake messages. TLS-SRP is a password-authenticated key agreement protocol that allows a client to authenticate to a server using a username and password derived from a pre-shared secret, without transmitting the secret itself. In the Linksys implementation on the MR9600 and MX4200, the server-side SRP verification process queries a local SQL database to fetch the stored verifier (password equivalent) for a given username presented by the client.

The root cause is improper neutralization of special elements (CWE-89) in the username field of the TLS-SRP handshake. The SRP username is passed directly into SQL string concatenation without parameterized queries or input sanitization. Specifically, the vulnerable code constructs a query similar to:

SELECT verifier, salt FROM srp_users WHERE username = '<client_supplied_username>'

Because the <client_supplied_username> value is concatenated without escaping, an attacker can terminate the SQL statement using a single quote (') and append malicious SQL clauses. The critical exploitation technique is the injection of a new user record via an INSERT or UNION statement or by leveraging INSERT ... ON CONFLICT / REPLACE semantics to overwrite or append credentials.

The handshake flow that triggers the vulnerability is:

1. Client Hello: Attacker initiates a TLS handshake with the srv_srp_username extension populated with a crafted username string.
2. Server-Side Query: The server extracts the username and constructs an SQL query against its local authentication database.
3. SQL Injection: The malicious username breaks out of the string literal and executes additional SQL commands.
4. Database Modification: The attacker injects a new SRP verifier record (or replaces an existing one) for a chosen username.
5. Second Handshake: The attacker performs a second TLS-SRP handshake using the now-registered username and the known password corresponding to the injected verifier, completing authentication successfully.

The attack requires two sequential TLS connections to the vulnerable service. Both the MR9600 and MX4200 expose TLS-SRP on their administrative/management ports (typically TCP 443 or alternate management ports). The affected versions are exact: MR9600 firmware 1.0.4.205530 and MX4200 firmware 1.0.13.210200. No other firmware versions are currently confirmed as vulnerable, but the affected range may extend to adjacent versions sharing code lineage.

Exploitation Scenarios

The following is a concrete attack chain for exploiting CVE-2026-27847.

Step 1 — Reconnaissance and Target Identification

An attacker begins by scanning for exposed Linksys MR9600 and MX4200 devices on the internet. Both devices are consumer-grade mesh routers frequently exposed to the public internet via UPnP port forwarding or direct ISP-assigned public IPs. The attacker uses Shodan/Censys queries to identify devices:

• A port scan (TCP 443, 8443, 10443) identifies hosts running TLS services with the TLS-SRP cipher suite advertised. The presence of TLS_SRP_SHA_WITH_AES_256_CBC_SHA (cipher suite 0x00C0) in the ServerHello indicates SRP support.
• Banner grabbing via OpenSSL: openssl s_client -connect <target>:443 -srp username=test -cipher SRP will reveal whether the server supports SRP by returning a ServerKeyExchange message with SRP parameters.

Step 2 — Trigger and SQL Injection

With a confirmed target, the attacker crafts a malicious TLS-SRP ClientHello. Using a custom TLS client (e.g., a Python script leveraging the tlslite-ng library), the attacker sets the SRP username to:

admin' UNION SELECT 'known_salt','known_verifier','1' FROM users WHERE '1'='1

A more reliable injection payload for SQLite (commonly used on embedded Linux routers) uses INSERT OR REPLACE to write a new record:

admin'; INSERT OR REPLACE INTO users (username, salt, verifier, is_admin) VALUES ('eviluser','61626364','known_verifier_hex','1'); --

The TLS handshake library may impose length or character restrictions; the attacker can URL-encode or use hexadecimal escaping if needed. The server processes the username, concatenates it into the SQL query, and the injected INSERT statement executes with database-write privileges.

Step 3 — Payload Execution and Authentication

After the injection succeeds, the attacker terminates the first TLS connection. The attacker now computes the SRP verifier for a known password (e.g., P@ssw0rd123) using the same salt value injected earlier:

verifier = sha256(salt + sha256(salt + sha256(username + ":" + password)))

The attacker initiates a second TLS-SRP handshake with username eviluser and the known password. The server fetches the stored verifier/salt from the database, performs the SRP key exchange, and the two sides derive a shared session key. The handshake completes successfully, and the attacker is authenticated as an administrative user.

Step 4 — Post-Exploitation Impact

With authenticated administrative access to the router, the attacker can:

• Modify DNS settings to redirect traffic to attacker-controlled servers (phishing, MITM).
• Disable firewall rules and open arbitrary ports for lateral movement into the home network.
• Exfiltrate Wi-Fi credentials, WPA2/WPA3 PSKs, and VPN configuration data.
• Install a persistent backdoor via firmware injection (if write access to flash is obtained).
• Use the compromised router as a proxy or pivot point for further network attacks against other devices on the LAN (IoT devices, PCs, cameras).

The attack requires no credentials, no user interaction, and can be performed remotely over the network in under 30 seconds. The injected credentials persist in the database across reboots (unless the device resets to factory defaults), granting long-term access.

Impact Assessment

The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 9.4 (Critical). This reflects:

• Confidentiality (High): An attacker can read the entire SRP authentication database, including username/salt/verifier tuples, Wi-Fi credentials, and possibly other stored secrets.
• Integrity (High): Database write capability allows injection of arbitrary credentials, modification of router configuration, and firmware tampering.
• Availability (High): An attacker can brick the device by corrupting the database or configuration, rendering the router inoperable.

Affected systems include all Linksys MR9600 (AX6000-class Wi-Fi 6 mesh router) running firmware version 1.0.4.205530 and all Linksys MX4200 (AX4200-class Velop mesh node) running firmware version 1.0.13.210200. Given the consumer market presence of these devices, the exposure is significant — both models are sold in North America, Europe, and Asia-Pacific regions through major retail channels.

The blast radius extends beyond the router itself. A compromised router serves as the network gateway; attackers can pivot to all connected LAN clients, intercept traffic, and maintain persistence. Because the vulnerability is unauthenticated and remotely exploitable, even a single exposed device on a public IP or via UPnP port forwarding is at risk. The SQL injection grants write access to the underlying database, which likely also stores device configuration and possibly local VPN credentials.

Detection Guidance

The following detection rules target the network signatures of TLS-SRP handshakes containing SQL metacharacters, as well as anomalous database access patterns on the affected devices.

Sigma Rule

title: CVE-2026-27847 Linksys TLS-SRP SQL Injection Attempt
id: 2d8f7c1a-9b4e-4a3f-b2c6-7d5e9a0f1c3b
status: experimental
description: Detects TLS-SRP handshakes containing SQL injection patterns in the username field, indicative of CVE-2026-27847 exploitation attempts against Linksys MR9600/MX4200 routers.
author: Valtersit Threat Intelligence
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        tls.srp.username|contains:
            - "' OR '1'='1"
            - "'; INSERT"
            - "'; DROP"
            - "'; UPDATE"
            - "'; DELETE"
            - "UNION SELECT"
            - "') UNION"
            - "'; --"
            - "/*"
            - "shutdown;"
    condition: selection
falsepositives:
    - Extremely rare; legitimate SRP usernames do not contain SQL metacharacters
level: critical
tags:
    - attack.t1190
    - cve.2026.27847
    - cwe.89

YARA Rule

rule CVE_2026_27847_TLS_SRP_SQLI {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects TLS-SRP ClientHello messages containing SQL injection payloads targeting Linksys MR9600/MX4200"
        date = "2026-02-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-27847"
    strings:
        $s1 = "UNION SELECT" ascii wide nocase
        $s2 = "INSERT INTO" ascii wide nocase
        $s3 = "INSERT OR REPLACE" ascii wide nocase
        $s4 = "SQL" ascii wide nocase
        $s5 = "' --" ascii wide
        $s6 = "' OR '1'='1" ascii wide
        // TLS SRP extension type (0x000E in handshake), heuristic match
        $tls_srp = { 00 0E 00 10 00 68 }
    condition:
        (any of ($s*) and any of ($tls_srp*)) or
        (all of ($s1, $s2) and filesize < 2MB)
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-27847 - Linksys TLS-SRP SQL Injection Attempt"; flow:to_server; content:"|00 0e|"; depth:8; content:"|22|"; within:50; pcre:"/[\x27\x22].{0,20}(UNION|INSERT|UPDATE|DELETE|DROP|OR\x20\x27\x31)/i"; classtype:attempted-admin; sid:20262784; rev:1; metadata:cve CVE-2026-27847; metadata:cwe CWE-89;)

Elastic Detection

sequence by destination.ip, source.ip with maxspan=5m
  [network where event.category == "network" and
     destination.port in (443, 8443, 10443) and
     network.protocol in ("tls", "ssl") and
     // TLS-SRP ClientHello with suspicious username
     wildcard(tls.srp.username, "*'*") or
     wildcard(tls.srp.username, "*\"*")]
  [network where event.category == "network" and
     destination.port in (443, 8443, 10443) and
     // Second handshake - successful auth after injection
     tls.handshake.completed == true and
     // Look for repeated connections from same source
     destination.ip != null]

Splunk SPL Query

index=network sourcetype="suricata" 
  (tls.srp.username="*'*" OR tls.srp.username="*\"*" OR tls.srp.username="*UNION*" OR tls.srp.username="*INSERT*")
  | stats count by src_ip, dest_ip, dest_port, tls.srp.username
  | where count > 1
  | rename src_ip as "Source IP", dest_ip as "Destination IP (Router)", dest_port as "Port", tls.srp.username as "SRP Username"
  | table Source IP, "Destination IP (Router)", Port, "SRP Username", count

Wazuh OSSEC Rule

<rule id="100287" level="15">
    <if_sid>546</if_sid>
    <match>UNION SELECT|INSERT INTO|INSERT OR REPLACE|OR '1'='1</match>
    <description>CVE-2026-27847: Possible SQL injection via TLS-SRP username on Linksys MR9600/MX4200</description>
    <group>authentication,attack,cve,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
    <var name="rule_level">15</var>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source at the time of writing. The vendor has not released a firmware update addressing CVE-2026-27847, and no workarounds have been officially documented.

1. Immediate Mitigations (Until Patch Available)

• Disable remote administration: If the router's management interface is exposed to the internet, immediately disable remote admin access. In the Linksys web UI, navigate to Administration > Remote Management and set to "Disable". This prevents external attackers from reaching the TLS-SRP service.
• Disable UPnP: Many routers expose management services via UPnP port mappings. Disable UPnP from Administration > UPnP > Disable to prevent automatic port forwarding from exposing the vulnerable service.
• Segment the network: Place the router behind a firewall or NAT appliance that restricts inbound access to only known trusted IPs. Do not expose management ports to the internet.
• Monitor network traffic: Deploy the detection rules above on the network perimeter to alert on TLS-SRP handshakes containing SQL metacharacters.
• Reboot after anomaly: If suspicious SQL injection attempts are detected, reboot the router to clear any injected database records (if the database is memory-resident). Note that if the database persists on flash, rebooting may not clear injected credentials.

2. Patch/Upgrade Steps

• Monitor for firmware updates: Check the Linksys support page for MR9600 and MX4200 firmware releases. As of this report, no patched firmware version exists. When released, the patched version will be higher than 1.0.4.205530 (MR9600) and higher than 1.0.13.210200 (MX4200) — likely 1.0.4.2xxxxx and 1.0.13.2xxxxx respectively.
• Factory reset and manual reconfiguration: If the affected firmware cannot be updated, consider resetting the router to factory defaults and reconfiguring manually. This does not fix the vulnerability but clears any database entries that may have been injected during a prior compromise.
• Substitute hardware: For organizations or high-risk users, replace affected units with routers from vendors with active security patching or those not implementing TLS-SRP.

3. Long-Term Hardening

• Enable automatic firmware updates: Configure the router to automatically install firmware updates when available to ensure prompt patching once Cisco/Linksys releases a fix.
• Use a firewall with intrusion detection: Deploy a network firewall (hardware or virtual) with Suricata/Snort rules to block malicious TLS-SRP handshakes at the perimeter.
• Disable TLS-SRP if unused: If the router management does not require SRP authentication (e.g., using standard username/password form login instead), disable the SRP service if configurable, or restrict access to local LAN only.
• Vendor accountability: File a support ticket with Linksys referencing CVE-2026-27847 to expedite patch development. Encourage enterprise resellers to hold Cisco accountable for providing timely fixes to their consumer networking product line.

References

1. NVD Entry: CVE-2026-27847 — NIST National Vulnerability Database
2. Linksys Support (product firmware pages): MR9600 Firmware History | MX4200 Firmware History — Check for future patched firmware releases.
3. MITRE ATT&CK: T1190 — Exploit Public-Facing Application
4. CWE Entry: CWE-89 — Improper Neutralization of Special Elements used in SQL Command
5. TLS-SRP Protocol Reference: RFC 5054 — Using the Secure Remote Password (SRP) Protocol for TLS Authentication

Threat Actor Activity: As of this report's publication, CISA KEV does not list CVE-2026-27847, indicating no confirmed exploitation-in-the-wild has been formally reported. The EPSS score of 0.00320 (24.5th percentile) suggests limited current exploitation activity. No threat actor campaigns have been publicly attributed to this vulnerability. However, given the critical severity and the "Public" PoC status, exploitation attempts are likely to increase once a functional exploit circulates within criminal and APT communities. Security teams should treat this as a priority for monitoring and mitigation even in the absence of patch availability.