CVE-2026-27847

CWE-89 — SQL Injection3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.1%
top 78.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linksys Mr9600Linksys Mx4200
Timeline
PublishedFeb 25

Description

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5linksys/mr96001.0.4.205530
▶CVEListV5linksys/mx42001.0.13.210200

🔴Vulnerability Details

2
GHSA
GHSA-w654-6gvp-6w5j: Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection↗2026-02-25
▶
CVEList
Missing authentication in Linksys MR9600, Linksys MX4200↗2026-02-25
▶
CVE-2026-27847 (CRITICAL CVSS 9.8) | Due to improper neutralization of s | cvebase.io