Home / Vulnerability Intelligence / CVE-2026-27849

CVE-2026-27849 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: February 27, 2026

MR9600 & MX4200 - Command Injection

Published: February 25, 2026Updated: February 27, 2026Remote Exploitable

Overview

MR9600 1.0.4.205530 and MX4200 1.0.13.210200 contain a command injection caused by missing neutralization of special elements in the update functionality of TLS-SRP connection, letting attackers execute arbitrary OS commands remotely, exploit requires network access to the mesh device.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 6.3%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary OS commands remotely, potentially leading to full device compromise.

Mitigation

Update to the latest available versions.

References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 1, 2026

🔴 CVE-2026-27849 - Critical (9.8) Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; M... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27849/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID: CVE-2026-27849
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: unconfirmed
EPSS: 6.3%
Social Posts: 1

CWE

CWE-78

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

6.3%Probability of exploitation in the next 30 days