EUVD-2026-94476
GHSA-gmqq-qr7p-pfwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent/L2 or wireless network position
-
DeliverySend crafted packets to Meraki device
-
ExploitTrigger CWE-119 buffer overflow
-
ExecutionCorrupt memory beyond component scope
-
ImpactAchieve code execution / device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Adjacent network positioning (CVSS AV:A): the attacker must be on the same Layer 2 segment, broadcast domain, or within wireless range of the affected Cisco Meraki device (MR wireless AP, MV camera, MX appliance, or Campus Gateway) - the flaw is NOT exploitable from the routed internet without such a foothold. No authentication (PR:N) and no user interaction (UI:N) are required, and default configurations appear affected per the generic hardening advisory. Limiting factors: the adjacency requirement means an attacker needs prior local/wireless access, which meaningfully constrains opportunistic mass exploitation; the exact enabled feature or protocol that triggers the CWE-119 buffer issue is not disclosed in the grouped advisory and should be confirmed with Cisco. |
| Impact | Signals are mixed and lean toward 'high CVSS, but not yet a demonstrated real-world priority.' The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.6) describes an unauthenticated, low-complexity attack with full confidentiality/integrity/availability impact and a scope change - severe on paper. However, the attack vector is Adjacent (AV:A), not Network, so this is NOT internet-wide remotely exploitable; the attacker must sit on the same Layer 2 / wireless segment or broadcast domain as the affected device. Critically, the vulnerability was INTERNALLY discovered by Cisco during a proactive security review, there is NO CISA KEV listing, NO EPSS score provided, and NO public exploit - so exploitation status is 'no public exploit identified at time of analysis.' There is no evidence of active or opportunistic exploitation. The description is also a grouped-hardening advisory covering 'multiple internally discovered vulnerabilities' under CWE-119, so the specific buffer-management defect, affected code path, and precise triggering conditions are NOT disclosed - this ambiguity should be verified against the Cisco advisory before treating the 9.6 as a drop-everything number. Net: patch on a normal-to-expedited cadence given high impact and the critical nature of the devices, but the Adjacent vector plus absence of any exploitation signal makes this lower immediate risk than a comparable AV:N/KEV-listed bug. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the local network - for example, by associating with a Meraki MR wireless SSID or reaching an MX/MV device on the same broadcast segment - sends crafted traffic that triggers a buffer management flaw (CWE-119) in the device software. Because no authentication or user interaction is required and the CVSS scope is changed, successful exploitation could yield code execution or full compromise of the device with impact beyond the vulnerable component. No public proof-of-concept exists; the issue was found internally by Cisco. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.
RemediationAI
Primary remediation is to apply the Cisco Meraki OS hardening release described in Cisco's advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH), which is the vendor-released fix for the buffer management issues tracked by CVE-2026-76464; patch status is "Patch available per vendor advisory" and no standalone fix version is published in the CVE data, so the exact patched firmware image per platform (Campus Gateway Software, Meraki MR, MV, and MX) must be taken from that advisory and applied via the Meraki dashboard for cloud-managed devices. Because the attack surface is the adjacent network (AV:A, PR:N, UI:N), the highest-value compensating controls until upgrade completes are segmentation and Layer 2 hardening: place Meraki APs, cameras, MX appliances, and gateways on dedicated management VLANs isolated from user and guest traffic, enforce 802.1X or MAB on access ports, enable DHCP snooping, dynamic ARP inspection, and storm control to limit an attacker's ability to reach or manipulate the device's L2 neighborhood, and restrict or disable unused SSIDs and management interfaces. The trade-off is that aggressive L2 isolation and 802.1X can break legitimate client roaming, Bonjour/mDNS discovery, and camera-to-NVR traffic, so these changes need staged testing; disabling wireless or management features outright reduces functionality and may not be acceptable for production APs. Given the undetermined trigger condition, also monitor Cisco's advisory for revision, correlate Meraki device logs for unexpected reboots or crashes that could indicate a memory-corruption attempt, and treat the CVE as high severity in patch-prioritization while recognizing that exploitation requires a pre-existing adjacent-network foothold.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the umbrella class for the classic memory-corruption family - stack and heap overflows, off-by-one writes, and unchecked length or index arithmetic - where software fails to validate that data written into a buffer stays within its allocated bounds. Cisco's advisory is a proactive hardening release covering multiple internally discovered issues grouped under this CWE rather than a single named defect, and the underlying buffer management problems sit in Meraki OS code shared across product lines. The CPE data confirms the blast radius: Cisco Meraki MR wireless access point software, Meraki MV camera firmware, Meraki MX appliance firmware, and Cisco Campus Gateway Software are all listed as affected with wildcard versions, meaning every build predating the hardening release is presumed vulnerable. The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates the attack is launched from an adjacent network position (AV:A) with low complexity, no privileges, and no user interaction, and because the scope is changed (S:C) a compromise of the Meraki component can affect resources beyond its own security authority, such as downstream network segments or management infrastructure. The combination of PR:N and AV:A means any device that can reach the Meraki node's L2 neighborhood - a rogue client, a compromised laptop on the same SSID, or an attacker within radio range - is a viable launch point once the specific vulnerable code path is identified.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent vector and no auth/UI match a wireless/L2 buffer-overflow in network gear; CWE-119 with changed scope plausibly yields full C/I/A impact, though grouped advisory limits certainty.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by this CVE-2026-76464 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.
Executive ViewAI
Cisco Meraki's wireless access points, cameras, and network appliances - the connectivity backbone for many distributed branch, retail, and campus environments - contain a critical memory-safety flaw that could allow someone positioned on the same network segment or within wireless range to disrupt or compromise those devices. Because the flaw is only reachable from an adjacent position rather than the public internet, exposure is concentrated in locations where physical and wireless perimeters are weak, and no discrete versioned fix is yet available. Leadership should treat this as a fleet-wide remediation and network-segmentation issue rather than a single-device patching task, since the affected estate spans wireless, video, and routing platforms.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing Layer 2 segmentation and 802.1X/port security on access ports, isolating wireless client traffic with client isolation and separate VLANs for guest and IoT devices, restricting east-west traffic between wireless, camera, and appliance segments with ACLs, limiting physical and RF proximity to access points and cameras, forwarding Meraki dashboard alerts to the SIEM for anomaly detection, and engaging Cisco TAC/Meraki support to obtain the vendor's internal hardening release and its product-by-product availability timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB