{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/874418#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nRDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution.\r\n\r\n### Description\r\nRDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI.\r\n\r\n**CVE-2026-19505**JWT (JSON Web Token) authentication in `javascript-templates/source/jst_functions.c` does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's `EVP_VerifyFinal()` function.\r\nA remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device.\r\n\r\n**CVE-2026-19506** The login process in `/usr/www2/check.jst` uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session.\r\nAn unauthenticated attacker can send a login request at the same time a legitimate administrator logs in. If the requests are timed correctly, the attacker's session may receive the administrator's successful authentication result, allowing access to the WebUI without knowing the correct password.\r\n\r\n**CVE-2026-19507** The login handler in `/usr/www2/check.jst` does not limit the length of the password submitted by a user. The application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt.\r\nA remote, unauthenticated attacker can submit very large password values to consume excessive CPU resources. Repeated requests can make the WebUI and related services slow or unresponsive, resulting in a denial-of-service condition.\r\n\r\n**CVE-2026-19508** The data parser in `javascript-templates/source/jst_post.c` does not properly validate malformed input before processing it in memory. A remote, unauthenticated attacker can send a specially crafted request that causes the Duktape WebUI (https://duktape.org/) process to access or modify memory incorrectly.\r\nDuring data parser processing and later during Duktape memory cleanup, indicating that application memory can be corrupted. An attacker may be able to use this vulnerability to cause a denial-of-service and potentially execute arbitrary code, although code execution has not been demonstrated.\r\n\r\n**CVE-2026-19509** The `ajaxSet_wireless_network_configuration.jst` handler does not properly validate the `ssid_number` value before passing it to the RDK-B routing service.\r\nAn authenticated administrator can supply an abnormally large value that causes memory corruption in the native `rtrouted` process. This condition can crash `rtrouted` and trigger an RBus service restart. Successful exploitation can cause a denial-of-service. Because the flaw results in native memory corruption, arbitrary code execution may also be possible.\r\n\r\n### Impact\r\nA remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service.\r\nAn authenticated administrator may be able to trigger memory corruption in the privileged `rtrouted` process and result in arbitrary code execution.\r\nSuccessful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially execution of attacker-controlled code on an affected device.\r\n\r\n### Solution\r\nUnfortunately, RDK Central was unreachable to coordinate these vulnerabilities. Until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks.\r\n\r\n### Acknowledgements\r\nThanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities. This document was written by Michael Bragg.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/874418"}],"title":"RDK-B WebUI contains multiple vulnerabilities","tracking":{"current_release_date":"2026-08-19T19:28:37+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.44"}},"id":"VU#874418","initial_release_date":"2026-08-19 19:28:37.057924+00:00","revision_history":[{"date":"2026-08-19T19:28:37+00:00","number":"1.20260819192837.1","summary":"Released on 2026-08-19T19:28:37+00:00"}],"status":"final","version":"1.20260819192837.1"}},"vulnerabilities":[{"title":"Heap-based buffer overflow in the multipart form-data parser in `jst_post.","notes":[{"category":"summary","text":"Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request."}],"cve":"CVE-2026-19508","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#874418"}]},{"title":"Improper input validation in `ajaxSet_wireless_network_configuration.","notes":[{"category":"summary","text":"Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter."}],"cve":"CVE-2026-19509","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#874418"}]},{"title":"Uncontrolled resource consumption in `check.","notes":[{"category":"summary","text":"Uncontrolled resource consumption in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause denial of service via excessively large password values."}],"cve":"CVE-2026-19507","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#874418"}]},{"title":"Race condition in `check.","notes":[{"category":"summary","text":"Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state."}],"cve":"CVE-2026-19506","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#874418"}]},{"title":"Improper cryptographic signature verification in `jst_functions.","notes":[{"category":"summary","text":"Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature."}],"cve":"CVE-2026-19505","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#874418"}]}],"product_tree":{"branches":[]}}