VU#874418: RDK-B WebUI contains multiple vulnerabilities
CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.
VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.
- Affects RDK-B WebUI version rdkb-2025q4-kirkstone in broadband gateways
- Authentication bypass can yield administrative access over the network
- Memory corruption may enable arbitrary code execution under certain conditions
- Race conditions and insufficient input validation among reported flaws
- Vendors
- RDK CentralCERT/CC
- Products
- RDK-B WebUI
- Organizations
- CERT/CC
From the original article
Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.