EUVD-2026-62718
GHSA-p7m5-wh78-3h6h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebUI HTTP endpoint on LAN
-
DeliverySend crafted multipart/form-data POST
-
ExploitOverflow heap buffer in jst_post.c parser
-
ExecutionCorrupt adjacent heap memory/control data
-
ImpactCrash WebUI or execute code on gateway
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the RDK-B WebUI HTTP(S) endpoint that accepts multipart/form-data POST requests on a device running the rdkb-2025q4-kirkstone build; per the CVSS vector (PR:N) no authentication is needed and (UI:N) no user interaction is required. The concrete trigger is a crafted multipart/form-data request to that parser. The principal limiting factor is exposure: gateway WebUI/admin interfaces are typically LAN-facing and not WAN-exposed by default, so an attacker generally needs to be on the local/management network unless the operator has deliberately exposed remote management; the flaw is also specific to this RDK-B WebUI build/component. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a trivially-triggerable, network-reachable, unauthenticated flaw, which on its face is a top-priority issue for any operator running the affected build. However, the signals conflict on real-world urgency: EPSS is only 0.29% (21st percentile), the CVE is absent from CISA KEV, and no POC is flagged, so there is no evidence of active or imminent mass exploitation. A key mitigating reality is that a broadband gateway WebUI is normally reachable only from the LAN side and not exposed to the WAN by default, which plausibly explains the low EPSS despite the critical score - genuine internet-wide unauthenticated exploitation depends on an operator exposing the management interface. RCE is described as only 'potential,' while the memory-corruption DoS is the more certain outcome. Net assessment: treat as a high-priority patch/mitigation target for anyone operating these gateways given the unauthenticated network vector and RCE potential, but the current data points to targeted rather than widespread exploitation risk; verify actual WAN reachability of the WebUI in your deployment before assuming default-remote exploitability. |
| Exploit ScenarioDerived | An attacker with network reachability to the gateway's WebUI sends a single crafted multipart/form-data POST request whose fields or boundaries overflow a heap buffer in jst_post.c, immediately crashing the WebUI (denial of service) and locking out legitimate administration. With further effort to control the corrupted heap allocation, the same primitive could be developed into remote code execution on the gateway; low attack complexity (AC:L) and no authentication (PR:N) mean no user interaction or credentials are needed, though no public exploit is known at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Remote unauthenticated memory corruption in RDK-B WebUI (build rdkb-2025q4-kirkstone.04.10.26) arises from a heap-based buffer overflow in the multipart/form-data parser in jst_post.c, letting an attacker send a single crafted POST request to corrupt heap memory. Confirmed impact is denial of service via crashing the WebUI service, with potential remote code execution on the broadband gateway if the overflow is weaponized. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low (0.29%, 21st percentile) despite the 9.8 CVSS.
RemediationAI
No vendor-released patch version is identified at time of analysis, so a specific fixed build cannot be cited; monitor RDK Central and your gateway vendor/operator for a corrected rdkb-kirkstone release and apply it once published (see https://developer.rdkcentral.com/documentation/documentation/rdk_broadband_documentation/components/webui/ and the research advisory at https://whitehats.pwr.edu.pl//blog/2026-08-19-multiple-vulnerabilities-in-rdkb/ ). Until a patch is available, the highest-value compensating control is to ensure the WebUI is bound only to the LAN/management interface and is not reachable from the WAN, and disable any remote-management feature that exposes it (trade-off: operators lose remote administration convenience). Additionally, place the WebUI behind a reverse proxy or WAF that validates and size-limits multipart/form-data requests and rate-limits POSTs to admin endpoints (trade-off: may break legitimate large form uploads and adds infrastructure), and enable crash monitoring/auto-restart of the WebUI process to reduce DoS dwell time. Restrict administrative access to a trusted management VLAN or source-IP allowlist where the platform supports it.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RDK-B (Reference Design Kit for Broadband) is open middleware that powers the management stack of broadband gateways and CPE devices; its WebUI provides the device administration interface (cpe:2.3:a:rdk:rdk-b_webui). The vulnerable code path is jst_post.c, which parses HTTP POST bodies including multipart/form-data submissions. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause: the parser fails to correctly bound a length or copy operation while handling multipart boundaries/fields, writing attacker-controlled data past an allocated heap buffer and corrupting adjacent heap structures.
Know when Rdk B Webui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, low-complexity network request triggers the overflow (AV:N/AC:L/PR:N/UI:N); confirmed DoS gives A:H and the RCE potential supports C:H/I:H, though real reachability is often LAN-limited.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in the multipart form-data parser in jst_post.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
Executive ViewAI
RDK-B broadband gateways are vulnerable to remote denial-of-service attacks that disrupt customer service delivery, with potential for more severe compromise if exploited for code execution. The vulnerability requires no authentication and can be triggered by a single malicious request, but current real-world exploitation likelihood remains low. Leadership should prioritize inventory and access controls now while planning for urgent patching once vendor fixes become available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict WebUI access to trusted administrative networks only via firewall rules; (2) disable remote WebUI access if not operationally required; (3) implement connection and rate limiting on WebUI service endpoints; (4) monitor access logs for multipart POST requests with abnormal payloads or Content-Length headers; (5) maintain backup gateway procedures for customer support continuity; (6) coordinate with RDK vendor on patch timeline and expedited testing windows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Rdk B Webui
View allAuthentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26,
Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenti
Denial of service in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 is achievable by any remote unauthenticated atta
Denial of service in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated remote attacker to crash the web
Exploit-DB