Submit #797086: Linksys MR9600 Firmware 2.0.6.206937 Command Injectioninfo

TitleLinksys MR9600 Firmware 2.0.6.206937 Command Injection
DescriptionAn authenticated OS command injection vulnerability exists in Linksys MR9600 firmware 2.0.6.206937. The issue is reachable through the JNAP action BTRequestGetSmartConnectStatus. The user-controlled `pin` parameter is passed into `bluetooth.btGetSmartConnectStatus2(pin)`, then concatenated into `/etc/init.d/run_central2.sh`, where it is ultimately used in `/usr/bin/btsetup_central $OPTION` without proper quoting. This allows an authenticated attacker to inject arbitrary shell commands and achieve root command execution. The vulnerable code path requires the device to be in Master mode.
Source⚠️ https://github.com/utmost3/cve/issues/2
User
 wuuu (UID 93536)
Submission04/04/2026 12:37 (22 days ago)
Moderation04/24/2026 21:40 (20 days later)
StatusAccepted
VulDB entry359544 [Linksys MR9600 2.0.6.206937 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus pin os command injection]
Points20

Do you know our Splunk app?

Download it now for free!