CVE-2026-27847 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: February 26, 2026
MR9600 & MX4200 - SQL Injection
Published: February 25, 2026Updated: February 26, 2026Remote Exploitable
Overview
MR9600 1.0.4.205530 and MX4200 1.0.13.210200 contain a SQL injection caused by improper neutralization of special elements in the TLS-SRP handshake, letting attackers inject credentials to bypass authentication, exploit requires network access to initiate handshake.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Attackers can inject credentials to bypass authentication and access protected services.
Mitigation
Update to the latest available versions beyond 1.0.4.205530 for MR9600 and 1.0.13.210200 for MX4200.
Related Resources
Details
- CVE ID
- CVE-2026-27847
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- sql_injection
- Status
- new
CWE
- CWE-89
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H