RDK-B WebUI flaws enable router auth bypass
Five unpatched RDK-B WebUI vulnerabilities let remote attackers bypass authentication, crash services, or corrupt memory on broadband gateway devices.
CERT/CC disclosed five vulnerabilities in the RDK-B (Reference Design Kit for Broadband) WebUI, the administrative interface used on broadband gateways and related networking devices. The most severe, CVE-2026-19505, stems from a broken JWT signature check that treats both valid and invalid signatures as successful, letting a remote unauthenticated attacker forge a token and gain full administrative access. A related race condition (CVE-2026-19506) allows session hijacking during concurrent logins, while an unbounded password-length flaw (CVE-2026-19507) enables CPU-exhaustion denial-of-service via oversized SHA-256 hashing operations.
Two additional flaws involve memory corruption: CVE-2026-19508 affects the Duktape-based JavaScript templating engine's data parser, and CVE-2026-19509 affects the native rtrouted routing service when handling wireless configuration requests, potentially crashing the RBus service and possibly enabling code execution. RDK Central was reportedly unreachable during the coordinated disclosure process, so no patch is currently available. CERT/CC recommends restricting WebUI access to trusted management networks and never exposing the interface directly to the Internet.
Collectively, these vulnerabilities could allow an unauthenticated network-adjacent attacker to fully compromise a broadband gateway's administrative interface, disrupt service, or corrupt memory in privileged processes. Given the broad deployment of RDK-B across ISP-provided customer premises equipment and the lack of an available fix, exposed or poorly segmented devices represent a meaningful risk, though no active exploitation has been reported.
Mentioned in this report
Detection guidance
RDK-B WebUI Authentication Bypass via Malformed JWT Signature
Detects HTTP requests to RDK-B broadband gateway WebUI authentication/admin endpoints carrying a JWT with an 'alg':'none' header or an empty/blank signature segment, consistent with CVE-2026-19505 where the WebUI accepts any signature as valid. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDK-B WebUI Authentication Bypass via Malformed JWT Signature
description: Detects HTTP requests to a broadband gateway WebUI presenting a JWT bearer
token with alg set to none or an empty trailing signature segment, matching the
CVE-2026-19505 auth-bypass pattern where the WebUI accepts unsigned/invalid tokens
as valid.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
product: null
detection:
selection_header:
cs-authorization|contains: 'Bearer '
selection_forged:
- cs-authorization|contains: eyJhbGciOiJub25lI
- cs-authorization|re: \.\.$
- cs-authorization|endswith: .
filter_static_assets:
cs-uri-stem|endswith:
- .css
- .js
- .png
- .ico
condition: selection_header and selection_forged and not filter_static_assets
falsepositives:
- Debugging tools or API test clients that send malformed tokens intentionally against
a lab/staging WebUI
- Misconfigured reverse proxies that strip or truncate Authorization headers before
logging
level: high
id: 6095ddb0-700a-57a5-8880-18493770a1ef
status: experimental
author: Vorant
RDK-B WebUI Login DoS via Oversized Password Field
Detects abnormally large POST bodies to the RDK-B WebUI login endpoint, consistent with CVE-2026-19507 where an unbounded password length triggers expensive repeated SHA-256 hashing and CPU exhaustion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDK-B WebUI Login DoS via Oversized Password Field
description: Detects HTTP POST requests to a broadband gateway WebUI login/authentication
endpoint with an unusually large request body size, consistent with the unbounded
password-length CPU-exhaustion flaw (CVE-2026-19507). A pattern of many such oversized
requests in a short window should be treated as a DoS attempt; this rule flags individual
oversized login requests as the precursor behaviour.
tags:
- attack.impact
- attack.t1499
logsource:
category: webserver
product: null
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /login
- /auth
- /session
cs-bytes|gt: 8192
filter_known_upload:
cs-uri-stem|contains:
- /firmware
- /backup
- /config/upload
condition: selection and not filter_known_upload
falsepositives:
- Legitimate clients submitting large multi-field login forms with embedded SSO tokens
or CSRF blobs
- Load-testing or QA tooling exercising the login endpoint with large payloads
level: medium
id: 7a0d2790-e5f4-5562-9d4f-44b258107b59
status: experimental
author: Vorant
RDK-B WebUI Wireless Config Request Triggering rtrouted Crash
Detects oversized or malformed HTTP requests to the RDK-B WebUI wireless configuration endpoint immediately followed by the rtrouted/RBus service terminating and restarting, consistent with the memory corruption flaw CVE-2026-19509. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RDK-B WebUI Wireless Config Request Triggering rtrouted Crash
description: Detects an oversized or malformed HTTP request to the wireless configuration
endpoint of an RDK-B WebUI paired with an abnormal restart of the rtrouted/RBus
process, matching the memory-corruption/crash pattern described for CVE-2026-19509.
Correlate the webserver event with the process restart occurring shortly afterward;
this rule expresses the request-side precondition.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: webserver
product: null
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /wireless
- /wifi
- /rbus
cs-bytes|gt: 4096
filter_normal_admin:
cs-uri-query|contains: action=status
condition: selection and not filter_normal_admin
falsepositives:
- Bulk wireless configuration pushes from ISP provisioning/ACS systems with large
payloads
- Firmware management tools exercising the wifi config API during routine maintenance
windows
level: medium
id: c03134c4-8cc8-53c1-8875-2f14a63208fb
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/874418
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free