CVE-2026-19507: RDK-B WebUI DoS Vulnerability

CVE-2026-19507 Overview

CVE-2026-19507 is an uncontrolled resource consumption vulnerability in the check.jst component of the RDK-B (Reference Design Kit for Broadband) WebUI. The affected version is rdkb-2025q4-kirkstone.04.10.26. A remote unauthenticated attacker can trigger denial of service by submitting excessively large password values to the WebUI. The RDK-B stack powers broadband customer premises equipment (CPE) such as residential gateways and cable modems, so exposure of the WebUI to the local network or the internet places the device at risk of service disruption.

Critical Impact
Remote unauthenticated attackers can exhaust device resources on RDK-B gateways, causing denial of service against the WebUI and potentially the broadband gateway itself.

Affected Products

RDK-B WebUI component check.jst
RDK-B build rdkb-2025q4-kirkstone.04.10.26
Broadband CPE devices built on the affected RDK-B release

Discovery Timeline

2026-08-19 - CVE-2026-19507 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-19507

Vulnerability Analysis

The vulnerability resides in check.jst, a server-side JavaScript template used by the RDK-B WebUI to validate password input. The template processes password values submitted through the WebUI without enforcing an upper bound on input size. When an attacker submits an excessively large password value, the handler consumes disproportionate CPU and memory while performing validation. On resource-constrained CPE hardware, this exhaustion is enough to make the WebUI unresponsive and can degrade the broader gateway process. The attack requires no authentication, so any actor able to reach the WebUI over the network can trigger the condition. EPSS data lists a low exploitation probability, but the low attack complexity keeps operational risk elevated for exposed devices. See the PWR whitehats research blog for the disclosure context.

Root Cause

The root cause is missing input length validation in the password-handling logic inside check.jst. The template accepts arbitrary-sized payloads and processes them without truncation, size limits, or resource ceilings. This is an uncontrolled resource consumption defect consistent with [CWE-400].

Attack Vector

An attacker submits an HTTP POST request to the WebUI endpoint that invokes check.jst, supplying a password field with an oversized value. The request requires no credentials. Repeated requests amplify the effect and can render the management interface unavailable. Refer to the RDK Central WebUI documentation for architectural details of the affected component.

Detection Methods for CVE-2026-19507

Indicators of Compromise

HTTP POST requests to the RDK-B WebUI containing password field values that exceed reasonable length thresholds (for example, more than a few kilobytes).
Repeated high-volume requests to check.jst originating from a single source address.
WebUI process spikes in CPU or memory usage on the gateway, followed by unresponsiveness.

Detection Strategies

Inspect WebUI access logs for anomalously large request bodies targeting authentication or password-check endpoints.
Correlate WebUI unavailability events with concurrent traffic bursts to the management interface.
Deploy network-layer request size inspection in front of exposed RDK-B management interfaces.

Monitoring Recommendations

Alert on outbound WAN reachability of the RDK-B WebUI, which should not be exposed to the public internet.
Monitor gateway health telemetry for repeated WebUI restarts or watchdog resets.
Track baseline request sizes to the WebUI and flag statistical outliers.

How to Mitigate CVE-2026-19507

Immediate Actions Required

Restrict access to the RDK-B WebUI to trusted local network segments only.
Block WAN-side access to the gateway management interface at the ISP or perimeter.
Apply rate limiting on requests to check.jst and related authentication endpoints.

Patch Information

No vendor patch reference is listed in the NVD entry at time of publication. Operators of RDK-B-based CPE should track updates from their device vendor and the RDK community. Consult the RDK Central WebUI documentation and the PWR whitehats disclosure for update information as it becomes available.

Workarounds

Enforce a maximum request body size at any reverse proxy or firewall fronting the WebUI.
Disable remote management of the WebUI where operationally acceptable.
Add server-side length validation on password fields if you maintain a downstream fork of check.jst.

bash

# Example: nginx reverse proxy limits in front of the RDK-B WebUI
client_max_body_size 8k;
limit_req_zone $binary_remote_addr zone=webui:10m rate=5r/s;

location /check.jst {
    limit_req zone=webui burst=10 nodelay;
    proxy_pass http://127.0.0.1:8080;
}