RDK-B WebUI CVE-2026-19507

No special conditions beyond network reachability of the WebUI login page are required. The CVSS vector confirms unauthenticated (PR:N), no user interaction (UI:N), and low complexity (AC:L) exploitation. The limiting factor in practice is network adjacency: RDK-B WebUI is typically bound to the LAN-side interface of residential gateways (192.168.x.x or similar), restricting exploitation to users already on the local network or to devices where the ISP or end user has exposed port 80/443 to the internet. No specific non-default configuration, feature flag, or protocol mode is required - the vulnerable code path is the default login handler present in all deployments of the affected version.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High) and accurately reflects that the attack is trivially automatable from the network with no prerequisites - a worst-case availability scenario for the affected device. However, EPSS at 0.22% (13th percentile) indicates very low observed exploitation probability relative to all scored CVEs, and the vulnerability is not listed in CISA KEV. No public exploit code has been reported. The practical blast radius is limited: RDK-B WebUI is typically accessible only on the LAN-side interface of residential gateways, meaning an attacker generally needs local network adjacency unless the ISP or user has exposed the management interface to the internet. For affected deployments, the consequence is device management unavailability - disruptive but not catastrophic absent chained exploitation. The combination of high CVSS and low EPSS is consistent with a straightforward but largely untargeted flaw in niche embedded firmware.

An attacker with network access to the RDK-B device's WebUI - typically a local network user or, in misconfigured deployments, a remote internet-based attacker - sends an HTTP POST request to the login endpoint with a password field containing megabytes of data. The check.jst handler processes the input without enforcing size limits, consuming available memory or CPU on the embedded device until the WebUI service crashes or becomes unresponsive. Legitimate users and administrators lose access to the management interface for the duration of the attack, which can be sustained with repeated low-rate requests.