CVE-2026-19509

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19508 RDK WebUI heap-based buffer overflow vulnerability

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

EUVD-2026-62718

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19508 RDK WebUI heap-based buffer overflow vulnerability

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-19509

The RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26) contains a vulnerability in the ajaxSet_wireless_network_configuration.jst handler due to improper input validation of the ssid_number parameter. An authenticated administrator can supply an abnormally large value, leading to memory corrupt...

CVE-2026-19509 RDK WebUI DOS vulnerability

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

EUVD-2026-62716

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19509 RDK WebUI DOS vulnerability

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-19507 RDK WebUI uncontrolled resource consumption

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

CVE-2026-19507

The RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26) contains a vulnerability in the /usr/www2/check.jst login handler due to uncontrolled resource consumption . The application fails to limit the length of submitted passwords and performs SHA-256 hashing on the entire input string. A remote,...

CVE-2026-19507 RDK WebUI uncontrolled resource consumption

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

EUVD-2026-62715

Uncontrolled resource consumption in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause denial of service via excessively large password values...

CVE-2026-19506

The RDK-B WebUI (version rdkb-2025q4-kirkstone.04.10.26) contains a race condition in the /usr/www2/check.jst file. The vulnerability arises because the login process uses a shared value to store password verification results. Due to improper synchronization, concurrent authentication requests ca...

CVE-2026-19506 RDK-B WebUI race condition vulnerability

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-19506 RDK-B WebUI race condition vulnerability

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

EUVD-2026-62712

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

EUVD-2026-62711

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-19505

The RDK-B WebUI (version rdkb-2025q4-kirkstone) is vulnerable to an authentication bypass due to improper cryptographic signature verification in jst_functions.c. The root cause is the incorrect handling of the return value from OpenSSL's EVP_VerifyFinal() function, which treats both valid and in...