VU#874418: RDK-B WebUI contains multiple vulnerabilities
Brief
Overview
RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes.
Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution. Description RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI.