CVE-2026-27849 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: February 26, 2026
MR9600 & MX4200 - Command Injection
Published: February 25, 2026Updated: February 26, 2026Remote Exploitable
Overview
MR9600 1.0.4.205530 and MX4200 1.0.13.210200 contain a command injection caused by missing neutralization of special elements in the update functionality of TLS-SRP connection, letting attackers execute arbitrary OS commands remotely, exploit requires network access to the mesh device.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Attackers can execute arbitrary OS commands remotely, potentially leading to full device compromise.
Mitigation
Update to the latest available versions.
Related Resources
Details
- CVE ID
- CVE-2026-27849
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- command_injection
- Status
- new
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H