RDK-B WebUI flaws enable router auth bypass
Five unpatched RDK-B WebUI vulnerabilities let remote attackers bypass authentication, crash services, or corrupt memory on broadband gateway devices.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed five vulnerabilities in the RDK-B (Reference Design Kit for Broadband) WebUI, the administrative interface used on broadband gateways and related networking devices. The most severe, CVE-2026-19505, stems from a broken JWT signature check that treats both valid and invalid signatures as successful, letting a remote unauthenticated attacker forge a token and gain full administrative access. A related race condition (CVE-2026-19506) allows session hijacking during concurrent logins, while an unbounded password-length flaw (CVE-2026-19507) enables CPU-exhaustion denial-of-service via oversized SHA-256 hashing operations.
Two additional flaws involve memory corruption: CVE-2026-19508 affects the Duktape-based JavaScript templating engine's data parser, and CVE-2026-19509 affects the native rtrouted routing service when handling wireless configuration requests, potentially crashing the RBus service and possibly enabling code execution. RDK Central was reportedly unreachable during the coordinated disclosure process, so no patch is currently available. CERT/CC recommends restricting WebUI access to trusted management networks and never exposing the interface directly to the Internet.
Collectively, these vulnerabilities could allow an unauthenticated network-adjacent attacker to fully compromise a broadband gateway's administrative interface, disrupt service, or corrupt memory in privileged processes. Given the broad deployment of RDK-B across ISP-provided customer premises equipment and the lack of an available fix, exposed or poorly segmented devices represent a meaningful risk, though no active exploitation has been reported.
Mentioned in this report
Detection guidance
RDK-B WebUI Login DoS via Oversized Password Field
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects abnormally large POST bodies to the RDK-B WebUI login endpoint, consistent with CVE-2026-19507 where an unbounded password length triggers expensive repeated SHA-256 hashing and CPU exhaustion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDK-B WebUI Login DoS via Oversized Password Field
description: Detects HTTP POST requests to a broadband gateway WebUI login/authentication
endpoint with an unusually large request body size, consistent with the unbounded
password-length CPU-exhaustion flaw (CVE-2026-19507). A pattern of many such oversized
requests in a short window should be treated as a DoS attempt; this rule flags individual
oversized login requests as the precursor behaviour.
tags:
- attack.impact
- attack.t1499
logsource:
category: webserver
product: null
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /login
- /auth
- /session
cs-bytes|gt: 8192
filter_known_upload:
cs-uri-stem|contains:
- /firmware
- /backup
- /config/upload
condition: selection and not filter_known_upload
falsepositives:
- Legitimate clients submitting large multi-field login forms with embedded SSO tokens
or CSRF blobs
- Load-testing or QA tooling exercising the login endpoint with large payloads
level: medium
id: 7a0d2790-e5f4-5562-9d4f-44b258107b59
status: experimental
author: Vorant
RDK-B WebUI Wireless Config Request Triggering rtrouted Crash
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects oversized or malformed HTTP requests to the RDK-B WebUI wireless configuration endpoint immediately followed by the rtrouted/RBus service terminating and restarting, consistent with the memory corruption flaw CVE-2026-19509. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDK-B WebUI Wireless Config Request Triggering rtrouted Crash
description: Detects an oversized or malformed HTTP request to the wireless configuration
endpoint of an RDK-B WebUI paired with an abnormal restart of the rtrouted/RBus
process, matching the memory-corruption/crash pattern described for CVE-2026-19509.
Correlate the webserver event with the process restart occurring shortly afterward;
this rule expresses the request-side precondition.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: webserver
product: null
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /wireless
- /wifi
- /rbus
cs-bytes|gt: 4096
filter_normal_admin:
cs-uri-query|contains: action=status
condition: selection and not filter_normal_admin
falsepositives:
- Bulk wireless configuration pushes from ISP provisioning/ACS systems with large
payloads
- Firmware management tools exercising the wifi config API during routine maintenance
windows
level: medium
id: c03134c4-8cc8-53c1-8875-2f14a63208fb
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/874418
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs