Opengear Console Server EUVD-2026-114719

Exploitation requires the appliance's web management interface (index.cgi) to be network-reachable by the attacker; no authentication is needed (PR:N) and no user interaction is required (UI:N), affecting IM72XX, CM71XX and ACM70XX appliances on firmware 4.8.0 through 5.5.2. The specific trigger is a multipart/form-data POST request carrying an overlong Content-Disposition name field. Limiting factors: the CVSS AC:H and AT:P metrics indicate the attack carries high complexity and a specific condition beyond the attacker's direct control (consistent with heap-overflow exploitation that must defeat memory layout), so while a crash is readily achievable, reliable exploitation to anything beyond denial of service is constrained; the confirmed impact in the description is limited to crashing the index.cgi process, with RCE only vendor-claimed. Deployments that do not expose the web management interface to untrusted networks are not remotely reachable through this vector.

The CVSS 4.0 base score of 8.4 (High) rests on an unauthenticated network vector (AV:N, PR:N, UI:N) but is tempered by AC:H and AT:P, meaning the attack carries high complexity and a specific attack requirement - successful exploitation is not a trivially repeatable one-shot. There is a material signal conflict that must be resolved before prioritization: the NVD description states only that the attacker can 'crash the index.cgi process' (a denial-of-service / availability outcome), yet the CVSS vector claims full confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H, SC:H/SI:H/SA:H) and one vendor reference is titled 'Buffer Overflow to RCE' - i.e. the vendor asserts code execution while the description only substantiates a crash. Treat RCE as vendor-claimed and crash as the confirmed, evidence-backed outcome; verify the achievable impact with Opengear before assuming remote code execution. On exploitation signals: the input provides no EPSS score, the CVE is not in CISA KEV, and no proof-of-concept or working exploit reference is present, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', indicating prompt but not emergency action. Net: this is a genuine priority for exposed Opengear console servers because these appliances govern out-of-band access to other infrastructure (hence the subsequent-system scope impact), but AC:H/AT:P and the absence of any exploitation evidence argue against treating it as an active-exploitation emergency. The decisive mitigating fact is that a fixed firmware (5.5.3) is already generally available.

An attacker with network reachability to the appliance's web management interface sends a crafted multipart/form-data POST request to index.cgi containing an overlong Content-Disposition name field, overflowing a heap buffer. This reliably crashes the index.cgi process (confirmed denial of service); Opengear's advisory further characterizes the flaw as escalating to remote code execution, though the NVD description substantiates only the crash. No public exploit was identified at time of analysis, and the CVSS AC:H/AT:P metrics indicate exploitation beyond a crash is non-trivial.