A critical OS command injection vulnerability in the Linksys MR9600 router allows remote attackers to execute arbitrary system commands, posing a severe risk of complete device compromise.

The vulnerability resides in the smartConnectConfigure function within the SmartConnect.lua file. By injecting malicious payloads into the configApSsid, configApPassphrase, srpLogin, or srpPassword arguments, an authenticated attacker can achieve OS command injection.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the affected router with elevated privileges. This could lead to full device takeover, unauthorized network access, interception of sensitive traffic, or the redirection of user traffic to malicious infrastructure. Given the CVSS score of 8.8, this flaw represents a significant threat to internal network integrity and confidentiality.

Immediate Action: There is currently no official patch available from the vendor; users should restrict administrative access to the router to trusted internal interfaces only and disable remote management features immediately.

Proactive Monitoring: Security teams should monitor network traffic for unusual outbound connections initiated by the router and review administrative access logs for suspicious input patterns in configuration requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect traffic destined for the router management interface, specifically looking for shell metacharacters in configuration parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the vulnerability researcher at GitHub.

This vulnerability presents a high risk to network infrastructure due to the potential for full system compromise. Because the vendor has not yet responded or provided a patch, it is imperative to isolate the management interface of all affected Linksys MR9600 devices from the public internet and limit access to highly restricted administrative segments until an official firmware update is released.