#linksys — Public Fediverse posts on home.social

JTI @[email protected] · 2026-08-14 · 14:00 UTC

@simplenomad @dennisf @cigitalgem @Deciphersec

Fair point indeed. So shall we file it under "rules are written in blood" and proceed to see the law adapting to this new world using those precedents?

In the 2000s the world needed to adapt to the reality of all that FOSS stuff being actually enforceable law and all and Linksys and AVM were the qualified and friendly precedents to advance the law back then.

Last time evolution to proper, sort-of stable and useful FOSS legislation took about 10 years.

I wonder what the equivalent of OpenWRT will be this time. At least that one's pretty useful, rite?

#foss #fosscompliance #ai #llm #avm #linksys #openwrt #frontiermodels #precedent #2000s

#foss #fosscompliance #ai #llm #avm #linksys

JTI @[email protected] · 2026-08-14 · 14:00 UTC

@simplenomad @dennisf @cigitalgem @Deciphersec

Fair point indeed. So shall we file it under "rules are written in blood" and proceed to see the law adapting to this new world using those precedents?

In the 2000s the world needed to adapt to the reality of all that FOSS stuff being actually enforceable law and all and Linksys and AVM were the qualified and friendly precedents to advance the law back then.

Last time evolution to proper, sort-of stable and useful FOSS legislation took about 10 years.

I wonder what the equivalent of OpenWRT will be this time. At least that one's pretty useful, rite?

#foss #fosscompliance #ai #llm #avm #linksys #openwrt #frontiermodels #precedent #2000s

#llm #avm #linksys #openwrt #frontiermodels #precedent

JTI @[email protected] · 2026-08-14 · 14:00 UTC

@simplenomad @dennisf @cigitalgem @Deciphersec

Fair point indeed. So shall we file it under "rules are written in blood" and proceed to see the law adapting to this new world using those precedents?

In the 2000s the world needed to adapt to the reality of all that FOSS stuff being actually enforceable law and all and Linksys and AVM were the qualified and friendly precedents to advance the law back then.

Last time evolution to proper, sort-of stable and useful FOSS legislation took about 10 years.

I wonder what the equivalent of OpenWRT will be this time. At least that one's pretty useful, rite?

#foss #fosscompliance #ai #llm #avm #linksys #openwrt #frontiermodels #precedent #2000s

#2000s #precedent #frontiermodels #openwrt #linksys #avm

Script Kiddie @[email protected] · 2026-07-18 · 13:19 UTC

How one #GPL #lawsuit accidentally created the homelab router that changed #networking forever

source: howtogeek.com/a-legal-accident…

It didn't take long for a group to take this source #code, inspect it, and start to modify it. This was #OpenWrt and it changed everything. By loading modified #firmware on the little Linksys, it was possible to unlock or add features that #Linksys did not intend for that model or price bracket.

#news #freedom #wifi #router #opensource #foss #floss #software #hardware #economy #law #community #story #history #development #coder

#development #news #economy #opensource #community #history

Script Kiddie @[email protected] · 2026-07-18 · 13:19 UTC

How one #GPL #lawsuit accidentally created the homelab router that changed #networking forever

source: howtogeek.com/a-legal-accident…

It didn't take long for a group to take this source #code, inspect it, and start to modify it. This was #OpenWrt and it changed everything. By loading modified #firmware on the little Linksys, it was possible to unlock or add features that #Linksys did not intend for that model or price bracket.

#news #freedom #wifi #router #opensource #foss #floss #software #hardware #economy #law #community #story #history #development #coder

#development #news #economy #opensource #community #history

Script Kiddie @[email protected] · 2026-07-18 · 13:19 UTC

How one #GPL #lawsuit accidentally created the homelab router that changed #networking forever

source: howtogeek.com/a-legal-accident…

It didn't take long for a group to take this source #code, inspect it, and start to modify it. This was #OpenWrt and it changed everything. By loading modified #firmware on the little Linksys, it was possible to unlock or add features that #Linksys did not intend for that model or price bracket.

#news #freedom #wifi #router #opensource #foss #floss #software #hardware #economy #law #community #story #history #development #coder

#development #news #economy #opensource #community #history

OffSequence @[email protected] · 2026-04-26 · 00:00 UTC

🚨 HIGH severity (CVSS 8.6) OS command injection in Linksys MR9600 (2.0.6.206937) — CVE-2026-6992. Remote attackers can gain control via the 'pin' argument. Exploit is public, no fix yet. Restrict remote access & monitor closely. https://radar.offseq.com/threat/cve-2026-6992-os-command-injection-in-linksys-mr96-18ae6106 #OffSeq #Vulnerability #Linksys

#offseq #vulnerability #linksys

OffSequence @[email protected] · 2026-04-26 · 00:00 UTC

🚨 HIGH severity (CVSS 8.6) OS command injection in Linksys MR9600 (2.0.6.206937) — CVE-2026-6992. Remote attackers can gain control via the 'pin' argument. Exploit is public, no fix yet. Restrict remote access & monitor closely. https://radar.offseq.com/threat/cve-2026-6992-os-command-injection-in-linksys-mr96-18ae6106 #OffSeq #Vulnerability #Linksys

#offseq #vulnerability #linksys

OffSequence @[email protected] · 2026-04-26 · 00:00 UTC

🚨 HIGH severity (CVSS 8.6) OS command injection in Linksys MR9600 (2.0.6.206937) — CVE-2026-6992. Remote attackers can gain control via the 'pin' argument. Exploit is public, no fix yet. Restrict remote access & monitor closely. https://radar.offseq.com/threat/cve-2026-6992-os-command-injection-in-linksys-mr96-18ae6106 #OffSeq #Vulnerability #Linksys

#linksys #vulnerability #offseq

OffSequence @[email protected] · 2026-04-26 · 00:00 UTC

🚨 HIGH severity (CVSS 8.6) OS command injection in Linksys MR9600 (2.0.6.206937) — CVE-2026-6992. Remote attackers can gain control via the 'pin' argument. Exploit is public, no fix yet. Restrict remote access & monitor closely. https://radar.offseq.com/threat/cve-2026-6992-os-command-injection-in-linksys-mr96-18ae6106 #OffSeq #Vulnerability #Linksys

#offseq #vulnerability #linksys

RedPacket Security @[email protected] · 2026-04-25 · 19:07 UTC

CVE Alert: CVE-2026-6992 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-6992-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-6992 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-04-25 · 19:07 UTC

CVE Alert: CVE-2026-6992 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-6992-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-6992 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-04-25 · 19:07 UTC

CVE Alert: CVE-2026-6992 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-6992-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-6992 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-04-25 · 19:07 UTC

CVE Alert: CVE-2026-6992 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-6992-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-6992 #linksys #mr9600

#mr9600 #linksys #cve #cybersecurity #threatintel #osint

RedPacket Security @[email protected] · 2026-04-25 · 19:07 UTC

CVE Alert: CVE-2026-6992 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-6992-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-6992 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

poleguy looking for lost tools @[email protected] · 2026-03-26 · 16:22 UTC

@antdude @rstevens I have one of those wrt54gl's mounted on my ice cream truck power-wheels car for development telemetry!

#ppprs #gokart #wifi #linksys

poleguy looking for lost tools @[email protected] · 2026-03-26 · 16:22 UTC

@antdude @rstevens I have one of those wrt54gl's mounted on my ice cream truck power-wheels car for development telemetry!

#ppprs #gokart #wifi #linksys

poleguy looking for lost tools @[email protected] · 2026-03-26 · 16:22 UTC

@antdude @rstevens I have one of those wrt54gl's mounted on my ice cream truck power-wheels car for development telemetry!

#ppprs #gokart #wifi #linksys

poleguy looking for lost tools @[email protected] · 2026-03-26 · 16:22 UTC

@antdude @rstevens I have one of those wrt54gl's mounted on my ice cream truck power-wheels car for development telemetry!

#ppprs #gokart #wifi #linksys

RedPacket Security @[email protected] · 2026-03-23 · 05:51 UTC

CVE Alert: CVE-2026-4558 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-4558-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-4558 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-03-23 · 05:51 UTC

CVE Alert: CVE-2026-4558 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-4558-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-4558 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-03-23 · 05:51 UTC

CVE Alert: CVE-2026-4558 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-4558-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-4558 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

RedPacket Security @[email protected] · 2026-03-23 · 05:51 UTC

CVE Alert: CVE-2026-4558 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-4558-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-4558 #linksys #mr9600

#mr9600 #linksys #cve #cybersecurity #threatintel #osint

RedPacket Security @[email protected] · 2026-03-23 · 05:51 UTC

CVE Alert: CVE-2026-4558 - Linksys - MR9600 - https://www.redpacketsecurity.com/cve-alert-cve-2026-4558-linksys-mr9600/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-4558 #linksys #mr9600

#osint #threatintel #cybersecurity #cve #linksys #mr9600

Bastian @[email protected] · 2026-02-22 · 08:49 UTC

@web_martin @fds2610 Es gibt keinen offiziellen Weg von #Amazon. Jetzt hat jemand einen #Exploit entwickelt, der den Bootloader entsperrt und den Weg für CustomROMs freimacht.
#LineageOS bietet sich an, da es #OpenSource ist und für den Betrieb auf unterschiedlichster Hardware vorbereitet ist.

So ähnlich läuft es schon seit Jahrzehnten. #DBox2, #Linksys #WRT54G, Windows Mobile PDAs,... bei allen wurde die #Firmware reversed und dann wurden Alternativen entwickelt.
Teilweise sind aus diesen Entwicklungen neue Produkte, Firmen oder Communities entstanden.

DBox2->#Dreambox->div. #Linux Receiver

Linksys WRT54G->#OpenWRT/#DD-WRT->z.B. Gli.NET

Ob man diesen anfänglichen Versuchen vertraut, bleibt natürlich jedem selbst überlassen. Ich find's jedenfalls super. Endlich geht sowas mal wieder 😀

#amazon #exploit #lineageos #opensource #dbox2 #linksys

Bastian @[email protected] · 2026-02-22 · 08:49 UTC

@web_martin @fds2610 Es gibt keinen offiziellen Weg von #Amazon. Jetzt hat jemand einen #Exploit entwickelt, der den Bootloader entsperrt und den Weg für CustomROMs freimacht.
#LineageOS bietet sich an, da es #OpenSource ist und für den Betrieb auf unterschiedlichster Hardware vorbereitet ist.

So ähnlich läuft es schon seit Jahrzehnten. #DBox2, #Linksys #WRT54G, Windows Mobile PDAs,... bei allen wurde die #Firmware reversed und dann wurden Alternativen entwickelt.
Teilweise sind aus diesen Entwicklungen neue Produkte, Firmen oder Communities entstanden.

DBox2->#Dreambox->div. #Linux Receiver

Linksys WRT54G->#OpenWRT/#DD-WRT->z.B. Gli.NET

Ob man diesen anfänglichen Versuchen vertraut, bleibt natürlich jedem selbst überlassen. Ich find's jedenfalls super. Endlich geht sowas mal wieder 😀

#linux #amazon #exploit #lineageos #opensource #dbox2

Bastian @[email protected] · 2026-02-22 · 08:49 UTC

@web_martin @fds2610 Es gibt keinen offiziellen Weg von #Amazon. Jetzt hat jemand einen #Exploit entwickelt, der den Bootloader entsperrt und den Weg für CustomROMs freimacht.
#LineageOS bietet sich an, da es #OpenSource ist und für den Betrieb auf unterschiedlichster Hardware vorbereitet ist.

So ähnlich läuft es schon seit Jahrzehnten. #DBox2, #Linksys #WRT54G, Windows Mobile PDAs,... bei allen wurde die #Firmware reversed und dann wurden Alternativen entwickelt.
Teilweise sind aus diesen Entwicklungen neue Produkte, Firmen oder Communities entstanden.

DBox2->#Dreambox->div. #Linux Receiver

Linksys WRT54G->#OpenWRT/#DD-WRT->z.B. Gli.NET

Ob man diesen anfänglichen Versuchen vertraut, bleibt natürlich jedem selbst überlassen. Ich find's jedenfalls super. Endlich geht sowas mal wieder 😀

#amazon #exploit #lineageos #opensource #dbox2 #linksys

Bastian @[email protected] · 2026-02-22 · 08:49 UTC

@web_martin @fds2610 Es gibt keinen offiziellen Weg von #Amazon. Jetzt hat jemand einen #Exploit entwickelt, der den Bootloader entsperrt und den Weg für CustomROMs freimacht.
#LineageOS bietet sich an, da es #OpenSource ist und für den Betrieb auf unterschiedlichster Hardware vorbereitet ist.

So ähnlich läuft es schon seit Jahrzehnten. #DBox2, #Linksys #WRT54G, Windows Mobile PDAs,... bei allen wurde die #Firmware reversed und dann wurden Alternativen entwickelt.
Teilweise sind aus diesen Entwicklungen neue Produkte, Firmen oder Communities entstanden.

DBox2->#Dreambox->div. #Linux Receiver

Linksys WRT54G->#OpenWRT/#DD-WRT->z.B. Gli.NET

Ob man diesen anfänglichen Versuchen vertraut, bleibt natürlich jedem selbst überlassen. Ich find's jedenfalls super. Endlich geht sowas mal wieder 😀

#linux #openwrt #dreambox #firmware #wrt54g #linksys

Bastian @[email protected] · 2026-02-22 · 08:49 UTC

@web_martin @fds2610 Es gibt keinen offiziellen Weg von #Amazon. Jetzt hat jemand einen #Exploit entwickelt, der den Bootloader entsperrt und den Weg für CustomROMs freimacht.
#LineageOS bietet sich an, da es #OpenSource ist und für den Betrieb auf unterschiedlichster Hardware vorbereitet ist.

So ähnlich läuft es schon seit Jahrzehnten. #DBox2, #Linksys #WRT54G, Windows Mobile PDAs,... bei allen wurde die #Firmware reversed und dann wurden Alternativen entwickelt.
Teilweise sind aus diesen Entwicklungen neue Produkte, Firmen oder Communities entstanden.

DBox2->#Dreambox->div. #Linux Receiver

Linksys WRT54G->#OpenWRT/#DD-WRT->z.B. Gli.NET

Ob man diesen anfänglichen Versuchen vertraut, bleibt natürlich jedem selbst überlassen. Ich find's jedenfalls super. Endlich geht sowas mal wieder 😀

#amazon #exploit #lineageos #opensource #dbox2 #linksys

Harry Sintonen @[email protected] · 2026-02-17 · 07:40 UTC

It would be interesting to hear the original justification for adding the following to the #Linksys MX4200 iptables:

-A INPUT -i eth0 -j wan2self
-A wan2self -j wan2self_ports
-A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self
-A xlog_accept_wan2self -j ACCEPT

It's not often you see something that is so difficult to argue to be something else than a deliberate #backdoor. https://seclists.org/fulldisclosure/2026/Feb/19

#linksys #backdoor

Harry Sintonen @[email protected] · 2026-02-17 · 07:40 UTC

It would be interesting to hear the original justification for adding the following to the #Linksys MX4200 iptables:

-A INPUT -i eth0 -j wan2self
-A wan2self -j wan2self_ports
-A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self
-A xlog_accept_wan2self -j ACCEPT

It's not often you see something that is so difficult to argue to be something else than a deliberate #backdoor. https://seclists.org/fulldisclosure/2026/Feb/19

#linksys #backdoor

Harry Sintonen @[email protected] · 2026-02-17 · 07:40 UTC

It would be interesting to hear the original justification for adding the following to the #Linksys MX4200 iptables:

-A INPUT -i eth0 -j wan2self
-A wan2self -j wan2self_ports
-A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self
-A xlog_accept_wan2self -j ACCEPT

It's not often you see something that is so difficult to argue to be something else than a deliberate #backdoor. https://seclists.org/fulldisclosure/2026/Feb/19

#linksys #backdoor

Harry Sintonen @[email protected] · 2026-02-17 · 07:40 UTC

It would be interesting to hear the original justification for adding the following to the #Linksys MX4200 iptables:

-A INPUT -i eth0 -j wan2self
-A wan2self -j wan2self_ports
-A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self
-A xlog_accept_wan2self -j ACCEPT

It's not often you see something that is so difficult to argue to be something else than a deliberate #backdoor. https://seclists.org/fulldisclosure/2026/Feb/19

#backdoor #linksys

Harry Sintonen @[email protected] · 2026-02-17 · 07:40 UTC

It would be interesting to hear the original justification for adding the following to the #Linksys MX4200 iptables:

-A INPUT -i eth0 -j wan2self
-A wan2self -j wan2self_ports
-A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self
-A xlog_accept_wan2self -j ACCEPT

It's not often you see something that is so difficult to argue to be something else than a deliberate #backdoor. https://seclists.org/fulldisclosure/2026/Feb/19

#linksys #backdoor

Bill @[email protected] · 2026-02-17 · 04:48 UTC

Bring out yer path traversal memes!!

https://seclists.org/fulldisclosure/2026/Feb/10

#linksys #vulnerability

Bill @[email protected] · 2026-02-17 · 04:48 UTC

Bring out yer path traversal memes!!

https://seclists.org/fulldisclosure/2026/Feb/10

#linksys #vulnerability

Bill @[email protected] · 2026-02-17 · 04:48 UTC

Bring out yer path traversal memes!!

https://seclists.org/fulldisclosure/2026/Feb/10

#linksys #vulnerability

Bill @[email protected] · 2026-02-17 · 04:48 UTC

Bring out yer path traversal memes!!

https://seclists.org/fulldisclosure/2026/Feb/10

#linksys #vulnerability

#vulnerability #linksys

Bill @[email protected] · 2026-02-17 · 04:48 UTC

Bring out yer path traversal memes!!

https://seclists.org/fulldisclosure/2026/Feb/10

#linksys #vulnerability

Harry Sintonen @[email protected] · 2026-02-16 · 21:56 UTC

Plethore of critical #Linksys MX4200 Wi-Fi router vulnerabilities (that were originally reported to Linksys nearly a year ago!) are still unfixed:

- [SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal https://seclists.org/fulldisclosure/2026/Feb/10
- [SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function https://seclists.org/fulldisclosure/2026/Feb/11
- [SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection https://seclists.org/fulldisclosure/2026/Feb/12
- [SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/13
- [SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/18
- [SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel
https://seclists.org/fulldisclosure/2026/Feb/19

On first read it might appear that many of these vulnerabilities would only be exploitable by accessing the device non-WAN interface(s) from inside the local network. However, due to the SYSS-2025-014 vulnerability the normally "LAN only RCE" vulnerabilities (SYSS-2025-010 and -011) and SQL injection (SYSS-2025-009) can be performed from the WAN interface (read: the internet). The attacker merely needs to make the connection originate from port 5222 (which is trivial to arrange via local bind before connect).

Update: Users of Linksys MX4200 should upgrade to firmware version 2.0.7.216620 or later. While not all of the security issues are fixed, it at least should stop the attacks via the WAN interface (SYSS-2025-014). https://support.linksys.com/kb/article/952-en/

#linksys #fulldisclosure #vulnerability #infosec #cybersecurity

Harry Sintonen @[email protected] · 2026-02-16 · 21:56 UTC

Plethore of critical #Linksys MX4200 Wi-Fi router vulnerabilities (that were originally reported to Linksys nearly a year ago!) are still unfixed:

- [SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal https://seclists.org/fulldisclosure/2026/Feb/10
- [SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function https://seclists.org/fulldisclosure/2026/Feb/11
- [SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection https://seclists.org/fulldisclosure/2026/Feb/12
- [SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/13
- [SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/18
- [SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel
https://seclists.org/fulldisclosure/2026/Feb/19

On first read it might appear that many of these vulnerabilities would only be exploitable by accessing the device non-WAN interface(s) from inside the local network. However, due to the SYSS-2025-014 vulnerability the normally "LAN only RCE" vulnerabilities (SYSS-2025-010 and -011) and SQL injection (SYSS-2025-009) can be performed from the WAN interface (read: the internet). The attacker merely needs to make the connection originate from port 5222 (which is trivial to arrange via local bind before connect).

Update: Users of Linksys MX4200 should upgrade to firmware version 2.0.7.216620 or later. While not all of the security issues are fixed, it at least should stop the attacks via the WAN interface (SYSS-2025-014). https://support.linksys.com/kb/article/952-en/

#linksys #fulldisclosure #vulnerability #infosec #cybersecurity

Harry Sintonen @[email protected] · 2026-02-16 · 21:56 UTC

Plethore of critical #Linksys MX4200 Wi-Fi router vulnerabilities (that were originally reported to Linksys nearly a year ago!) are still unfixed:

- [SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal https://seclists.org/fulldisclosure/2026/Feb/10
- [SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function https://seclists.org/fulldisclosure/2026/Feb/11
- [SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection https://seclists.org/fulldisclosure/2026/Feb/12
- [SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/13
- [SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/18
- [SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel
https://seclists.org/fulldisclosure/2026/Feb/19

On first read it might appear that many of these vulnerabilities would only be exploitable by accessing the device non-WAN interface(s) from inside the local network. However, due to the SYSS-2025-014 vulnerability the normally "LAN only RCE" vulnerabilities (SYSS-2025-010 and -011) and SQL injection (SYSS-2025-009) can be performed from the WAN interface (read: the internet). The attacker merely needs to make the connection originate from port 5222 (which is trivial to arrange via local bind before connect).

Update: Users of Linksys MX4200 should upgrade to firmware version 2.0.7.216620 or later. While not all of the security issues are fixed, it at least should stop the attacks via the WAN interface (SYSS-2025-014). https://support.linksys.com/kb/article/952-en/

#linksys #fulldisclosure #vulnerability #infosec #cybersecurity

Harry Sintonen @[email protected] · 2026-02-16 · 21:56 UTC

Plethore of critical #Linksys MX4200 Wi-Fi router vulnerabilities (that were originally reported to Linksys nearly a year ago!) are still unfixed:

- [SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal https://seclists.org/fulldisclosure/2026/Feb/10
- [SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function https://seclists.org/fulldisclosure/2026/Feb/11
- [SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection https://seclists.org/fulldisclosure/2026/Feb/12
- [SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/13
- [SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/18
- [SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel
https://seclists.org/fulldisclosure/2026/Feb/19

On first read it might appear that many of these vulnerabilities would only be exploitable by accessing the device non-WAN interface(s) from inside the local network. However, due to the SYSS-2025-014 vulnerability the normally "LAN only RCE" vulnerabilities (SYSS-2025-010 and -011) and SQL injection (SYSS-2025-009) can be performed from the WAN interface (read: the internet). The attacker merely needs to make the connection originate from port 5222 (which is trivial to arrange via local bind before connect).

Update: Users of Linksys MX4200 should upgrade to firmware version 2.0.7.216620 or later. While not all of the security issues are fixed, it at least should stop the attacks via the WAN interface (SYSS-2025-014). https://support.linksys.com/kb/article/952-en/

#linksys #fulldisclosure #vulnerability #infosec #cybersecurity

#cybersecurity #infosec #vulnerability #fulldisclosure #linksys

Harry Sintonen @[email protected] · 2026-02-16 · 21:56 UTC

Plethore of critical #Linksys MX4200 Wi-Fi router vulnerabilities (that were originally reported to Linksys nearly a year ago!) are still unfixed:

- [SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal https://seclists.org/fulldisclosure/2026/Feb/10
- [SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function https://seclists.org/fulldisclosure/2026/Feb/11
- [SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection https://seclists.org/fulldisclosure/2026/Feb/12
- [SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/13
- [SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection https://seclists.org/fulldisclosure/2026/Feb/18
- [SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel
https://seclists.org/fulldisclosure/2026/Feb/19

On first read it might appear that many of these vulnerabilities would only be exploitable by accessing the device non-WAN interface(s) from inside the local network. However, due to the SYSS-2025-014 vulnerability the normally "LAN only RCE" vulnerabilities (SYSS-2025-010 and -011) and SQL injection (SYSS-2025-009) can be performed from the WAN interface (read: the internet). The attacker merely needs to make the connection originate from port 5222 (which is trivial to arrange via local bind before connect).

Update: Users of Linksys MX4200 should upgrade to firmware version 2.0.7.216620 or later. While not all of the security issues are fixed, it at least should stop the attacks via the WAN interface (SYSS-2025-014). https://support.linksys.com/kb/article/952-en/

#linksys #fulldisclosure #vulnerability #infosec #cybersecurity

Jeremy Naus @[email protected] · 2026-01-14 · 19:32 UTC

Had half day off today.
Thought I'd "simply" set up some #vlan: one main, one #IoT, and one for my #poe ip cameras.
It took some work to set it up on my #GL.iNET #Flint3 #router, my
#Linksys #LGS528P was simple to setup
But after some tweaking (8 hours later) it seems all is now going well.
Even @homeassistant works in the new setup

#vlan #iot #poe #gl #flint3 #router

Jeremy Naus @[email protected] · 2026-01-14 · 19:32 UTC

Had half day off today.
Thought I'd "simply" set up some #vlan: one main, one #IoT, and one for my #poe ip cameras.
It took some work to set it up on my #GL.iNET #Flint3 #router, my
#Linksys #LGS528P was simple to setup
But after some tweaking (8 hours later) it seems all is now going well.
Even @homeassistant works in the new setup

#vlan #iot #poe #gl #flint3 #router

Jeremy Naus @[email protected] · 2026-01-14 · 19:32 UTC

Had half day off today.
Thought I'd "simply" set up some #vlan: one main, one #IoT, and one for my #poe ip cameras.
It took some work to set it up on my #GL.iNET #Flint3 #router, my
#Linksys #LGS528P was simple to setup
But after some tweaking (8 hours later) it seems all is now going well.
Even @homeassistant works in the new setup