RDK-B WebUI CVE-2026-19505

Exploitation requires network reachability to the RDK-B WebUI management interface and the ability to submit a crafted JWT to an endpoint that authenticates via jst_functions.c; no valid credentials, user interaction, or prior privileges are needed (CVSS PR:N/UI:N). The concrete prerequisite is that the target runs the vulnerable rdkb-2025q4-kirkstone WebUI build whose JWT signature verification accepts an invalid RSA signature. The main limiting factor is reachability: on typical ISP-managed gateways the WebUI is exposed only to the LAN or a management network, so an attacker generally must already be on the local network or the operator's management plane rather than the open Internet; devices that expose the WebUI to untrusted/WAN networks face unauthenticated remote takeover.

Signals here partly conflict and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes an ideal attack: network-reachable, low complexity, no privileges, no user interaction, full compromise of confidentiality, integrity and availability - a textbook critical authentication bypass. Against that, EPSS is only 0.19% (9th percentile), and there is no CISA KEV listing and no public exploit identified, indicating no observed or predicted widespread exploitation yet. This gap is best explained by the product's niche exposure profile: RDK-B WebUI is typically an internal LAN-side management interface on ISP-managed gateways, not an Internet-facing service, so the network vector is real but reachability is often limited to the local network or the operator's management plane. The bug class (accepting invalid JWT signatures) is trivial to weaponize once a device is reachable, so any device that does expose the WebUI to untrusted networks should be treated as critical. Overall: genuinely high technical severity, but real-world mass-exploitation risk is moderated by limited external reachability rather than by exploit difficulty.

An attacker who can reach the RDK-B WebUI over the network - for example on the LAN of a vulnerable gateway or via any WAN-exposed management port - crafts a JWT that claims an administrative identity and signs it with an arbitrary/invalid RSA signature. Because jst_functions.c fails to properly verify the signature, the token is accepted and the attacker is granted an authenticated admin session, letting them reconfigure the device, capture traffic, or pivot into the network. No public proof-of-concept is identified at time of analysis, but the low attack complexity means exploitation is straightforward once the interface is reachable.