CVE-2026-27846

Published: Feb 25, 2026Modified: Jun 17, 2026Deferred

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.5 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network to gain access to sensitive information, including the password for admin access to the web interface and the Wi-Fi passwords.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-002.txt

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Timeline

No history available yet.