CVE-2026-12495 Overview
CVE-2026-12495 is a stack-based buffer overflow [CWE-121] in the http_gdpr_decrypt function of the Mercusys MB115-4G router's web administration interface. An unauthenticated attacker on an adjacent network can send a specially crafted request to the /cgi/login endpoint. The malformed input corrupts stack memory and crashes the httpd process. The result is a denial-of-service (DoS) condition against the device's web management service. The vulnerability does not affect confidentiality or integrity, but it disrupts administrative availability. INCIBE CERT published the coordinated advisory tracking this issue.
Critical Impact
Unauthenticated adjacent attackers can crash the router's web administration daemon by sending a crafted request to /cgi/login, disabling remote management access.
Affected Products
- Mercusys MB115-4G router (web interface)
- httpd service exposing the /cgi/login endpoint
- Firmware versions containing the vulnerable http_gdpr_decrypt implementation
Discovery Timeline
- 2026-07-27 - CVE-2026-12495 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-12495
Vulnerability Analysis
The flaw resides in http_gdpr_decrypt, a function that processes encrypted payloads submitted to the login endpoint. The function copies attacker-controlled data into a fixed-size stack buffer without validating the input length. When the supplied payload exceeds the buffer boundary, adjacent stack memory including the saved return address is overwritten. This corruption crashes the httpd worker handling web administration.
The attack vector is Adjacent (AV:A), meaning the attacker must reach the router's LAN segment or Wi-Fi network. No authentication or user interaction is required. Impact is limited to availability, as the corruption is observed to terminate the service rather than yield reliable code execution in the reported analysis. EPSS reports a low near-term exploitation probability, and no public proof-of-concept is currently listed.
Root Cause
The root cause is missing bounds validation on data passed to http_gdpr_decrypt before it is written into a stack buffer. The function trusts a length or terminator derived from attacker-controlled request fields sent to /cgi/login. Standard defensive practices, such as verifying the declared payload length against the destination buffer size or using bounded copy primitives, are absent. The weakness is tracked as [CWE-121] Stack-based Buffer Overflow.
Attack Vector
An attacker on the adjacent network issues an HTTP request to /cgi/login on the router's management interface. The request body contains an oversized or malformed encrypted field consumed by http_gdpr_decrypt. The oversized copy overruns the stack buffer, corrupts the return address, and terminates the httpd process. Repeated requests keep the web administration service unavailable until the device is rebooted or the daemon respawns. See the INCIBE CERT Security Notice for the coordinated advisory.
Detection Methods for CVE-2026-12495
Indicators of Compromise
- Unexpected termination or repeated restarts of the httpd process on the MB115-4G device.
- HTTP POST requests to /cgi/login containing abnormally long or malformed encrypted payload fields.
- Loss of access to the web administration interface while the router continues to route traffic.
- Bursts of /cgi/login requests originating from a single adjacent host.
Detection Strategies
- Inspect LAN-side HTTP traffic for oversized request bodies targeting /cgi/login on router management IPs.
- Alert on repeated 5xx responses or connection resets from the router's web interface.
- Correlate device availability probes with concurrent traffic to management endpoints.
Monitoring Recommendations
- Enable syslog forwarding from the router and monitor for httpd crash messages.
- Baseline normal administrative HTTP traffic to the router and alert on statistical deviations.
- Track adjacent-network hosts that scan or repeatedly contact router management interfaces.
How to Mitigate CVE-2026-12495
Immediate Actions Required
- Restrict access to the router's web administration interface to trusted management VLANs or hosts only.
- Disable remote and Wi-Fi-side access to the management UI where operationally feasible.
- Monitor the INCIBE CERT Security Notice and Mercusys support channels for firmware updates.
- Reboot the device to restore management access if the httpd process has been crashed.
Patch Information
No vendor patch reference is listed in the enriched CVE data at time of writing. Administrators should track Mercusys firmware release notes for the MB115-4G and apply any update that addresses the http_gdpr_decrypt bounds-checking defect. Confirm remediation by verifying the fixed firmware version after upgrade.
Workarounds
- Segment the router's management interface onto a dedicated administrative VLAN with ACL-enforced source restrictions.
- Block untrusted client access to /cgi/login at an upstream firewall or gateway where possible.
- Disable Wi-Fi access to the administrative interface, requiring wired management sessions.
- Rotate administrator credentials and audit management access logs after any suspected DoS event.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
