RDK-B WebUI vulnerabilities
4 known vulnerabilities in RDK-B WebUI from RDK. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
RDK-B WebUI: Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via
- 7.5 High severity
RDK-B WebUI: Uncontrolled Resource Consumption
Uncontrolled resource consumption in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause denial of service via excessively large password values.
- 8.1 High severity
RDK-B WebUI: Concurrent Execution using Shared Resource with Improper Synchronization
Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state.
- 9.8 Critical severity
RDK-B WebUI: Improper Verification of Cryptographic Signature
Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.