A firewall rule that was incorrectly configured on the router allows any connection to the WAN port to be accepted when the source port is 5222, providing access to services that are normally reachable only from the local network. The weakness exists due to improper access control and can result in confidential data exposure, unauthorized service use, or further compromise of the local network. The control is a classic example of the CWE‑284 “Improper Access Control” problem.

Linksys MR9600 running firmware version 1.0.4.205530 and Linksys MX4200 running firmware version 1.0.13.210200 are impacted by the vulnerability. Both routers are able to accept traffic from the WAN with source port 5222, bypassing the intended firewall restriction.

The CVSS score of 7.5 indicates a high severity condition. However the EPSS score is below 1 % which suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to craft packets with source port 5222 from the external network, so the attack vector is purely network‑based and does not require authentication. Due to the low exploitation probability, the risk is moderate but the impact should be treated seriously because the exposure allows direct interaction with otherwise protected services.