What is CVE-2026-25603?

CVE-2026-25603 is a medium-severity vulnerability in Linksys Mr9600, classified under Path Traversal. CVSS score: 6.6/10. Published 2026-02-24.

How severe is CVE-2026-25603?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Path Traversal in Linksys Mr9600

CVE-2026-25603

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This m…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (17.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Linksys Mr9600 — versions 1.0.4.205530
Linksys Mr9600_firmware — versions 1.0.4.205530
Linksys Mx4200 — versions 1.0.13.210200
Linksys Mx4200_firmware — versions 1.0.4.205530

Weakness classification (CWE)

CWE-22 — Path Traversal

References

a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2026-25603?: CVE-2026-25603 is a medium-severity vulnerability in Linksys Mr9600, classified under Path Traversal. CVSS score: 6.6/10. Published 2026-02-24.
How severe is CVE-2026-25603?: Medium severity. CVSS v3 base score is 6.6 out of 10.