VU#874418: RDK-B WebUI contains multiple vulnerabilities

RDK Central RDK-B WebUI version rdkb-2025q4-kirkstone contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. With network access to an affected WebUI, an attacker may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes, and under certain conditions that memory corruption may potentially be leveraged for arbitrary code execution.

Five vulnerabilities have been identified in the RDK-B WebUI. The JWT authentication in javascript-templates/source/jst_functions.c for CVE-2026-19505 does not correctly verify whether a token's cryptographic signature is valid because the application treats both a valid signature and an invalid signature as successful verification by incorrectly checking the return value from OpenSSL's EVP_VerifyFinal() function. CVE-2026-19506 states that the login process in /usr/www2/check.jst uses a shared value to store the result of password verification, so the application may return one user's authentication result to another user's session when an unauthenticated attacker sends a login request at the same time a legitimate administrator logs in with requests timed correctly. CVE-2026-19507 states that the login handler in /usr/www2/check.jst does not limit the length of the password submitted by a user, and the application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt, allowing an unauthenticated attacker to submit very large password values to consume excessive CPU resources. CVE-2026-19508 states that the data parser in javascript-templates/source/jst_post.c does not properly validate malformed input before processing it in memory, allowing a remote unauthenticated attacker to send a specially crafted request that causes the Duktape WebUI process to access or modify memory incorrectly, with memory corruption potentially occurring during data parser processing and later during Duktape memory cleanup. CVE-2026-19509 states that the ajaxSet_wireless_network_configuration.jst handler does not properly validate the ssid_number value before passing it to the RDK-B routing service, and an authenticated administrator can supply an abnormally large value that causes memory corruption in the native rtrouted process, which can crash rtrouted and trigger an RBus service restart, with denial-of-service possible and arbitrary code execution potentially possible because the flaw results in native memory corruption.

A remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service. An authenticated administrator may be able to trigger memory corruption in the privileged rtrouted process and result in arbitrary code execution. Successful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially execution of attacker-controlled code on an affected device.

RDK Central was unreachable to coordinate these vulnerabilities, and until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks.

Thanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities, and the document was written by Michael Bragg.

The original article was written by Michael Bragg.