A critical OS command injection vulnerability in Linksys MR9600 firmware allows authenticated attackers to execute arbitrary system commands, posing a risk of total device compromise.

This vulnerability resides in the BTRequestGetSmartConnectStatus function within the /etc/init.d/run_central2.sh script. It is triggered by improper input validation of the pin argument, allowing an authenticated remote attacker to perform OS command injection.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system of the router. This level of access typically results in complete device control, potentially allowing for network interception, traffic redirection, or the use of the device as a pivot point into the internal network. With a CVSS score of 7.2, the impact is considered High, reflecting the potential for total system compromise and loss of confidentiality, integrity, and availability of the gateway device.

Immediate Action: As there is no official patch currently available, users should restrict administrative access to the router management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous activity, specifically looking for unexpected command executions or requests directed at the JNAP interface that contain shell metacharacters.

Compensating Controls: Implement a strict firewall policy that limits access to the router's web management interface to a dedicated, secure management VLAN or specific administrator workstations.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub issue.

Given the availability of a public proof-of-concept and the critical nature of command injection on network infrastructure, this vulnerability represents a significant risk. Administrators are strongly urged to monitor vendor communications for a firmware update and apply it immediately upon release. Until a fix is provided, reduce the attack surface by ensuring the management interface is not exposed to the public internet or untrusted network segments.