Os commands can be injected through the update functionality of a TLS‑SRP connection because special elements are not neutralized. This flaw enables attackers to execute arbitrary system commands on the affected device, providing full control over the device’s operating system. The high CVSS score of 9.8 reflects the severity and the ability to compromise confidentiality, integrity, and availability of the network.

Linksys MR9600 version 1.0.4.205530 and Linksys MX4200 version 1.0.13.210200 are the specific models and firmware releases affected. These devices are used to configure routers and mesh networks and therefore are pivotal to network operation.

The CVSS score of 9.8 indicates a critical risk, while the EPSS score of less than 1 % suggests that current exploitation attempts are low but still possible. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack vector—via a TLS‑SRP update channel—could let an attacker with network access perform the injection. The flaw permits unattended code execution, making it a high‑impact threat to any system incorporating the listed firmware.