{"vuid":"VU#874418","idnumber":"874418","name":"RDK-B WebUI contains multiple vulnerabilities","keywords":null,"overview":"### Overview\r\nRDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution.\r\n\r\n### Description\r\nRDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI.\r\n\r\n**CVE-2026-19505**JWT (JSON Web Token) authentication in `javascript-templates/source/jst_functions.c` does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's `EVP_VerifyFinal()` function.\r\nA remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device.\r\n\r\n**CVE-2026-19506** The login process in `/usr/www2/check.jst` uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session.\r\nAn unauthenticated attacker can send a login request at the same time a legitimate administrator logs in. If the requests are timed correctly, the attacker's session may receive the administrator's successful authentication result, allowing access to the WebUI without knowing the correct password.\r\n\r\n**CVE-2026-19507** The login handler in `/usr/www2/check.jst` does not limit the length of the password submitted by a user. The application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt.\r\nA remote, unauthenticated attacker can submit very large password values to consume excessive CPU resources. Repeated requests can make the WebUI and related services slow or unresponsive, resulting in a denial-of-service condition.\r\n\r\n**CVE-2026-19508** The data parser in `javascript-templates/source/jst_post.c` does not properly validate malformed input before processing it in memory. A remote, unauthenticated attacker can send a specially crafted request that causes the Duktape WebUI (https://duktape.org/) process to access or modify memory incorrectly.\r\nDuring data parser processing and later during Duktape memory cleanup, indicating that application memory can be corrupted. An attacker may be able to use this vulnerability to cause a denial-of-service and potentially execute arbitrary code, although code execution has not been demonstrated.\r\n\r\n**CVE-2026-19509** The `ajaxSet_wireless_network_configuration.jst` handler does not properly validate the `ssid_number` value before passing it to the RDK-B routing service.\r\nAn authenticated administrator can supply an abnormally large value that causes memory corruption in the native `rtrouted` process. This condition can crash `rtrouted` and trigger an RBus service restart. Successful exploitation can cause a denial-of-service. Because the flaw results in native memory corruption, arbitrary code execution may also be possible.\r\n\r\n### Impact\r\nA remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service.\r\nAn authenticated administrator may be able to trigger memory corruption in the privileged `rtrouted` process and result in arbitrary code execution.\r\nSuccessful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially execution of attacker-controlled code on an affected device.\r\n\r\n### Solution\r\nUnfortunately, RDK Central was unreachable to coordinate these vulnerabilities. Until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks.\r\n\r\n### Acknowledgements\r\nThanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities. This document was written by Michael Bragg.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":[],"cveids":["CVE-2026-19505","CVE-2026-19506","CVE-2026-19507","CVE-2026-19509","CVE-2026-19508"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-08-19T19:28:37.195099Z","publicdate":"2026-08-19T19:28:37.057924Z","datefirstpublished":"2026-08-19T19:28:37.210827Z","dateupdated":"2026-08-19T19:28:37.057921Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":235}