# RDK-B WebUI flaws enable router auth bypass

Published: 2026-08-19 · Severity: routine · Sectors: telecommunications, infrastructure
Canonical: https://vorant.io/reports/152e9b55-f7fd-585d-88b9-c0a9dec824bd/rdk-b-webui-flaws-enable-router-auth-bypass

> Five unpatched RDK-B WebUI vulnerabilities let remote attackers bypass authentication, crash services, or corrupt memory on broadband gateway devices.

CERT/CC disclosed five vulnerabilities in the RDK-B (Reference Design Kit for Broadband) WebUI, the administrative interface used on broadband gateways and related networking devices. The most severe, CVE-2026-19505, stems from a broken JWT signature check that treats both valid and invalid signatures as successful, letting a remote unauthenticated attacker forge a token and gain full administrative access. A related race condition (CVE-2026-19506) allows session hijacking during concurrent logins, while an unbounded password-length flaw (CVE-2026-19507) enables CPU-exhaustion denial-of-service via oversized SHA-256 hashing operations.

Two additional flaws involve memory corruption: CVE-2026-19508 affects the Duktape-based JavaScript templating engine's data parser, and CVE-2026-19509 affects the native rtrouted routing service when handling wireless configuration requests, potentially crashing the RBus service and possibly enabling code execution. RDK Central was reportedly unreachable during the coordinated disclosure process, so no patch is currently available. CERT/CC recommends restricting WebUI access to trusted management networks and never exposing the interface directly to the Internet.

Collectively, these vulnerabilities could allow an unauthenticated network-adjacent attacker to fully compromise a broadband gateway's administrative interface, disrupt service, or corrupt memory in privileged processes. Given the broad deployment of RDK-B across ISP-provided customer premises equipment and the lack of an available fix, exposed or poorly segmented devices represent a meaningful risk, though no active exploitation has been reported.

## Mentioned in this report

- Vulnerabilities: CVE-2026-19505, CVE-2026-19506, CVE-2026-19507, CVE-2026-19508, CVE-2026-19509

## Detection guidance (public sample)

### RDK-B WebUI Authentication Bypass via Malformed JWT Signature

ATT&CK: T1190

Detects HTTP requests to RDK-B broadband gateway WebUI authentication/admin endpoints carrying a JWT with an 'alg':'none' header or an empty/blank signature segment, consistent with CVE-2026-19505 where the WebUI accepts any signature as valid. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RDK-B WebUI Authentication Bypass via Malformed JWT Signature
description: Detects HTTP requests to a broadband gateway WebUI presenting a JWT bearer
  token with alg set to none or an empty trailing signature segment, matching the
  CVE-2026-19505 auth-bypass pattern where the WebUI accepts unsigned/invalid tokens
  as valid.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
  product: null
detection:
  selection_header:
    cs-authorization|contains: 'Bearer '
  selection_forged:
  - cs-authorization|contains: eyJhbGciOiJub25lI
  - cs-authorization|re: \.\.$
  - cs-authorization|endswith: .
  filter_static_assets:
    cs-uri-stem|endswith:
    - .css
    - .js
    - .png
    - .ico
  condition: selection_header and selection_forged and not filter_static_assets
falsepositives:
- Debugging tools or API test clients that send malformed tokens intentionally against
  a lab/staging WebUI
- Misconfigured reverse proxies that strip or truncate Authorization headers before
  logging
level: high
id: 6095ddb0-700a-57a5-8880-18493770a1ef
status: experimental
author: Vorant
```

### RDK-B WebUI Login DoS via Oversized Password Field

ATT&CK: T1499

Detects abnormally large POST bodies to the RDK-B WebUI login endpoint, consistent with CVE-2026-19507 where an unbounded password length triggers expensive repeated SHA-256 hashing and CPU exhaustion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RDK-B WebUI Login DoS via Oversized Password Field
description: Detects HTTP POST requests to a broadband gateway WebUI login/authentication
  endpoint with an unusually large request body size, consistent with the unbounded
  password-length CPU-exhaustion flaw (CVE-2026-19507). A pattern of many such oversized
  requests in a short window should be treated as a DoS attempt; this rule flags individual
  oversized login requests as the precursor behaviour.
tags:
- attack.impact
- attack.t1499
logsource:
  category: webserver
  product: null
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - /login
    - /auth
    - /session
    cs-bytes|gt: 8192
  filter_known_upload:
    cs-uri-stem|contains:
    - /firmware
    - /backup
    - /config/upload
  condition: selection and not filter_known_upload
falsepositives:
- Legitimate clients submitting large multi-field login forms with embedded SSO tokens
  or CSRF blobs
- Load-testing or QA tooling exercising the login endpoint with large payloads
level: medium
id: 7a0d2790-e5f4-5562-9d4f-44b258107b59
status: experimental
author: Vorant
```

### RDK-B WebUI Wireless Config Request Triggering rtrouted Crash

ATT&CK: T1068

Detects oversized or malformed HTTP requests to the RDK-B WebUI wireless configuration endpoint immediately followed by the rtrouted/RBus service terminating and restarting, consistent with the memory corruption flaw CVE-2026-19509. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RDK-B WebUI Wireless Config Request Triggering rtrouted Crash
description: Detects an oversized or malformed HTTP request to the wireless configuration
  endpoint of an RDK-B WebUI paired with an abnormal restart of the rtrouted/RBus
  process, matching the memory-corruption/crash pattern described for CVE-2026-19509.
  Correlate the webserver event with the process restart occurring shortly afterward;
  this rule expresses the request-side precondition.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: webserver
  product: null
detection:
  selection:
    cs-method:
    - POST
    - PUT
    cs-uri-stem|contains:
    - /wireless
    - /wifi
    - /rbus
    cs-bytes|gt: 4096
  filter_normal_admin:
    cs-uri-query|contains: action=status
  condition: selection and not filter_normal_admin
falsepositives:
- Bulk wireless configuration pushes from ISP provisioning/ACS systems with large
  payloads
- Firmware management tools exercising the wifi config API during routine maintenance
  windows
level: medium
id: c03134c4-8cc8-53c1-8875-2f14a63208fb
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/874418

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/152e9b55-f7fd-585d-88b9-c0a9dec824bd/rdk-b-webui-flaws-enable-router-auth-bypass.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup