Linksys MR9600 and MX4200 OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Linksys MR9600 and MX4200 routers, specifically in the update functionality of a TLS-SRP connection used for device configuration within the mesh network. This vulnerability arises from inadequate sanitization of input, allowing OS commands to be injected and executed on the device.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a crafted update request through a TLS-SRP connection to the device's service running on TCP port 6060. The injected command can be verified by observing the device's LED indicator, which will change color to indicate successful execution.