CVE-2026-27847

critical · 9.8

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

9.8

CVSS

0.3%

EPSS (exploit prob.)

25th

EPSS percentile

2026-02-25

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-27847