Do Son 
TL;DR
CERT/CC disclosed five RDK-B WebUI vulnerabilities on August 19, 2026. The worst flaw lets a remote, unauthenticated attacker bypass login and gain admin control of a broadband gateway. No fix exists yet, because RDK Central could not be reached.
- Product: RDK-B WebUI
- Vulnerabilities: 3 flaws (CVE-2026-19505, CVE-2026-19506, CVE-2026-19508)
- Highest severity: Awaiting analysis
- Worst impact: improper cryptographic signature verification
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-19505 | Awaiting analysis | improper cryptographic signature verification | — | Not exploited |
| CVE-2026-19506 | Awaiting analysis | race condition | — | Not exploited |
| CVE-2026-19508 | Awaiting analysis | WebUI heap-based buffer overflow | — | Not exploited |
Why it matters
RDK-B powers many broadband gateways and home routers. The WebUI is how admins configure these devices. A login bypass hands an attacker full control of that interface.
From there, an attacker can change device settings, break service, or possibly run code. The affected build is rdkb-2025q4-kirkstone, per the CERT/CC advisory.
How the attack works
The advisory lists five distinct issues. Three stand out for remote, unauthenticated attackers.
CVE-2026-19505: broken JWT check
This is the headline flaw. The WebUI mishandles the result of a signature check. As the advisory puts it, the code “treats both a valid signature and an invalid signature as successful verification.”
Therefore, an attacker can forge a token with a bad signature and still log in as the privileged user.
CVE-2026-19506: login race condition
The login handler stores its result in a shared value. Because of that, the app “may return one user’s authentication result to another user’s session.” A well-timed request can hijack an admin’s successful login.
CVE-2026-19508: memory corruption
A data parser fails to validate malformed input. A crafted request can corrupt memory in the Duktape engine. This may cause a crash or, potentially, code execution, though the advisory notes that “code execution has not been demonstrated.”
Affected versions
CERT/CC names the RDK-B WebUI build rdkb-2025q4-kirkstone. RDK-B ships in many broadband devices, so exact install counts are not published. The advisory does not confirm any exploitation in the wild, and no public proof-of-concept has been reported.
Patch and mitigation
No patch is available. RDK Central was unreachable during coordination, according to the CERT/CC vulnerability note.
Until a fix ships, limit exposure. Restrict WebUI access to trusted management networks and known hosts. Above all, never expose the admin interface to the Internet. These steps reduce the risk from the RDK-B WebUI vulnerabilities described here.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
