CVE-2026-102212
Pre-Auth Heap Buffer Overflow in the Multipart Request
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects the firmware of Opengear IM72XX, CM71XX, and ACM70XX console server appliances. An unauthenticated remote attacker can send a specially crafted web request to crash the device's index.cgi process, causing a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Opengear IM7200
From 4.8 · through 5.5.2
- Opengear CM7100
From 4.8 · through 5.5.2
- Opengear ACM7000
From 4.8 · through 5.5.2