CVE-2026-19508

A heap-based buffer overflow in jst_post.c (multipart form-data parser) in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to send a crafted multipart/form-data request, causing memory corruption, denial of service, and potentially arbitrary code execut...

EUVD-2026-62718

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19509

Improper input validation in ajaxSet_wireless_network_configuration.jst of RDK-B WebUI (rdkb-2025q4-kirkstone.04.10.26) allows an authenticated attacker to trigger denial of service via a crafted ssid_number parameter. No exploit or patch details are provided in the available documents.

EUVD-2026-62716

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

EUVD-2026-62715

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

CVE-2026-19506

A race condition in the check.jst file of RDK-B WebUI (firmware version rdkb-2025q4-kirkstone.04.10.26) allows a remote attacker to gain unauthorized access by sending concurrent authentication requests that exploit shared authentication state. No patch or workaround is documented; the issue was ...

EUVD-2026-62712

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

EUVD-2026-62711

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-19505

A flaw in jst_functions.c of RDK-B WebUI (rdkb-2025q4-kirkstone.04.10.26) fails to properly verify JWT RSA signatures, allowing a remote attacker to submit a forged token and gain administrative access. No patch version or exploit details are provided in the available documents.

RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...

PT-2024-9220 · Mediatek +1 · Mediatek Microchips +1

Name of the Vulnerable Software and Affected Versions: MediaTek microchip software affected versions not specified Android versions 12.0 through 15.0 openWRT versions 19.07 through 23.05 Yocto version 4.0 RDK-B versions 22Q3 through 24Q1 Description: The issue is related to an out-of-bounds write...