CVE-2026-25603

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-256045.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instaCVE-2026-256057.1A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without propCVE-2026-256068.7A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters alCVE-2026-256075.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords withCVE-2026-256082.3STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25618.8A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcaCVE-2026-256106.5An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-256117.5A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.CVE-2026-256126.5The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. CollecCVE-2026-256136.5An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-256147.5Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.