EUVD-2026-94479
GHSA-c56x-q3cx-9pww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on adjacent network segment
-
DeliverySend crafted packets to Meraki/Gateway device
-
ExploitTrigger incorrect-calculation (CWE-682) flaw
-
ExecutionCorrupt state or execute unintended logic
-
ImpactCompromise device confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Exploitation requires the attacker to be on an adjacent network (AV:A) - i.e., the same local/Layer-2 broadcast domain, management VLAN, or directly connected network segment as a vulnerable Cisco Meraki MR wireless AP, MV camera, MX security appliance, or Campus Gateway running the affected software; it is NOT exploitable from an arbitrary remote internet host. No authentication (PR:N) and no user interaction (UI:N) are required, and attack complexity is low (AC:L). The primary LIMITING factor is the adjacency requirement, which confines exploitation to attackers who have already achieved local network presence; the generic advisory text does not name a specific feature, protocol, or non-default configuration, so no additional configuration prerequisite can be confirmed from the available data. |
| Impact | Signals are mixed and lean toward moderate real-world urgency despite a high CVSS base score of 8.8. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates an adjacent-network, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact - serious in principle, but the AV:A (Adjacent) metric meaningfully limits exposure versus a network-routable (AV:N) flaw, since the attacker must already have a foothold on the same Layer-2/adjacent segment. No EPSS score, CISA KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. Crucially, this CVE originates from Cisco's own internal proactive security review and groups MULTIPLE internally discovered vulnerabilities under CWE-682 (Incorrect Calculation, a Pillar-level weakness) - the description provides no specific vulnerable component, trigger, or exploitation mechanics. SSVC framework data is absent. Net assessment: this is a legitimate patch-worthy issue for Meraki/Campus Gateway operators given the high impact, but the adjacent-only vector, internal (not external) discovery, and absence of any exploitation evidence suggest it is not an emergency compared to actively-exploited network-facing CVEs. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vector, which implies far more than disclosure - verify scope with the Cisco advisory. |
| Exploit ScenarioDerived | An attacker who has gained a position on the same adjacent/local network segment as a vulnerable Meraki MR/MV/MX device or Campus Gateway (e.g., via a compromised adjacent host or rogue device on the LAN/management VLAN) sends crafted traffic that triggers the incorrect-calculation flaw, requiring no authentication or user interaction. Successful exploitation could compromise confidentiality, integrity, and availability of the affected appliance. No public proof-of-concept or exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
RemediationAI
Cisco's hardening release for these internally discovered issues is documented in the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH - patch available per vendor advisory, with no exact fixed version number present in the supplied data, so confirm the correct target release per platform from the advisory before upgrading. Apply that release to every affected Cisco Meraki MR access point, MV camera, MX security appliance, and Campus Gateway; because Meraki hardware is cloud-managed, upgrades are typically staged through the dashboard, but verify the firmware actually applied since scheduled upgrade windows can leave devices running the vulnerable build. If immediate upgrade is not possible, all meaningful compensating controls target the AV:A adjacency requirement: segment management and device VLANs so untrusted hosts cannot share a broadcast domain with the devices, disable unused switch ports and apply port security or 802.1X/NAC to block unauthorized Layer-2 access, limit wireless client onboarding to trusted devices, and monitor for anomalous local traffic directed at device management interfaces. These measures reduce exposure but do not eliminate the flaw, and they carry operational trade-offs - tighter segmentation and NAC can complicate guest access, camera onboarding, and legitimate provisioning workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-682 (Incorrect Calculation) is a pillar weakness class covering arithmetic and logic errors such as integer overflow or underflow, off-by-one sizing, incorrect length or index computation, and faulty protocol-field math - errors that typically surface during buffer allocation, packet parsing, or memory handling. The affected code paths live in the operating software of Cisco Meraki MR access points, MV cameras, MX security appliances, and Cisco Campus Gateway software, which means the flaws are reachable from the local network layer those devices service. The assessed vector AV:A/AC:L/PR:N/UI:N/S:U with C:H/I:H/A:H describes a low-complexity, unauthenticated attack launched from an adjacent segment that yields broad impact on the device itself rather than a credential-gated privilege escalation. Cisco packages the findings from its internal review into a single hardening release, and the available advisory text does not name the specific feature, protocol, or non-default configuration involved, so no additional precondition can be confirmed; note also that the accompanying intelligence tag labels the class as Information Disclosure, which is narrower than the assessed confidentiality, integrity, and availability impact.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector and unauthenticated low-complexity access per Cisco's vector; retained C/I/A:H as the description's bundled CWE-682 flaws and 8.8 score indicate full device compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76470 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.
Executive ViewAI
Cisco's Meraki MR access points, MV cameras, MX security appliances, and Campus Gateway software are affected by calculation flaws that let an attacker who already has a foothold on the same network segment degrade or disrupt the confidentiality, integrity, and availability of these devices. Because the affected products are the connectivity and physical-security backbone of branch, retail, and campus environments, a successful attack could interrupt wireless and wired access, cloud-managed device control, and video surveillance coverage at any site running unpatched hardware. No vendor patch is currently available, though no public exploit has been identified at time of analysis, so leadership should treat this as a near-term exposure-management and network-segmentation priority rather than an active incident.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Layer-2 adjacency to trusted hosts, place management interfaces on a dedicated segmented VLAN reachable only from hardened admin systems, enforce 802.1X/NAC on access ports, disable unused switch ports, monitor adjacent-segment traffic for anomalies, and pursue Cisco TAC for workaround guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB