The vulnerability is an authentication bypass that allows a user with physical access to the Linksys device to use the mesh functionality to add a new mesh node. By doing so, the attacker can read sensitive information, notably the administrative login credentials for the web interface and the passwords for the Wi‑Fi network. This gives the attacker full administrative control over the router and network, potentially compromising all connected devices. Affected systems include the Linksys MR9600 running firmware 1.0.4.205530 and the Linksys MX4200 running firmware 1.0.13.210200. No other versions are listed as affected. The risk is moderate, as reflected by a CVSS score of 6.2, but the exploitation probability is low (EPSS < 1%). The issue is not currently listed in the CISA KEV catalogue. The most likely attack vector requires physical proximity to the device; no remote or network‑only exploitation is described.

Linksys MR9600 (firmware 1.0.4.205530) and Linksys MX4200 (firmware 1.0.13.210200).

With a moderate CVSS score but very low EPSS, the overall exposure is limited, especially if physical security controls are in place. Compromise is feasible only when an attacker can physically reach the device; networking exposure is not evident from the description.