RDK-B WebUI CVE-2026-19509

Exploitation requires a valid, authenticated account on the RDK-B WebUI with at least low-level privileges, as confirmed by the CVSS PR:L metric - unauthenticated attackers cannot trigger this vulnerability. The vulnerable endpoint ajaxSet_wireless_network_configuration.jst handles wireless configuration AJAX calls and must be reachable, which is the default condition for WebUI-enabled RDK-B devices. No non-default configuration, specific platform, or additional feature flag is required beyond the WebUI service being active. The authentication requirement is the primary limiting factor: exploitation is constrained to actors who possess valid WebUI credentials, whether obtained through prior compromise, weak default passwords, or credential reuse.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a network-accessible DoS requiring only low-privilege authentication, with no confidentiality or integrity impact. EPSS at 0.16% (6th percentile) signals very low observed exploitation probability, consistent with a DoS-only finding in a niche embedded platform component. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. The practical risk is limited: an adversary must already hold a valid WebUI account, and the impact - crashing the management interface - does not directly disrupt broadband data-plane functions unless the WebUI process is tightly coupled to routing services on the specific device. This is a genuine but low-priority finding for most organizations; the authentication prerequisite significantly reduces mass-exploitation potential, making it a realistic threat primarily in scenarios where credentials are shared, weak, or already compromised.

An attacker with low-privilege access to the RDK-B WebUI - such as a standard subscriber account or compromised technician credential - sends a crafted HTTP AJAX request to ajaxSet_wireless_network_configuration.jst containing a malformed ssid_number parameter value. The handler fails to validate the input, triggering a crash or hung state in the WebUI service and rendering device management unavailable until the service is restarted. No public exploit code has been identified at time of analysis.