RDK-B WebUI CVE-2026-19506

The primary enabling condition is network accessibility of the RDK-B WebUI - the attacker must be able to reach the management interface port via HTTP or HTTPS. The CVSS PR:N vector confirms no prior authentication is required. The race condition requires the ability to send high-rate parallel requests to check.jst with precise timing, meaning reliable exploitation demands concurrent connection capability and likely multiple attempts to win the race window. The AC:H rating reflects this timing dependency and limits casual or fully automated exploitation. Devices where the WebUI is bound only to a LAN-side interface behind NAT without port-forwarding, or restricted to a management VLAN, are substantially protected - an attacker without LAN or management network access cannot reach the vulnerable endpoint. No non-default feature flag or special configuration is documented as required beyond the WebUI being reachable.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures a high-severity network-exploitable authentication bypass tempered by elevated exploitation complexity - the race condition requires precisely timed concurrent requests and may demand multiple attempts to win the race window. EPSS at 0.21% (12th percentile) reflects low observed exploitation activity consistent with the AC:H barrier and the specialized nature of CPE management interfaces, which are often not internet-exposed by default. There is no CISA KEV listing and no public exploit code identified at time of analysis, which further supports the low near-term exploitation probability. However, public disclosure by whitehats.pwr.edu.pl on 2026-08-19 as part of a multi-vulnerability blog post meaningfully raises the likelihood of proof-of-concept development. SSVC framing: exploitation status is public-disclosure only; automability is uncertain given AC:H; technical impact is total upon successful exploitation. Operators managing large CPE fleets should treat this as a high-priority remediation item given that successful exploitation yields full device control with no authentication required.

An attacker with network access to the RDK-B WebUI port sends a high-rate burst of simultaneous unauthenticated login requests to check.jst, racing to hit the shared authentication state before it is cleared between requests. If the race window is won, one of the requests inherits a transiently authenticated session context, granting the attacker full administrative access to the gateway device without valid credentials. No public exploit code has been identified at time of analysis, but the August 2026 multi-vulnerability disclosure by whitehats.pwr.edu.pl raises the likelihood that a proof-of-concept could emerge.