CVE-2026-102212

HighCVSS 8.4/10Last modified Nov 6, 2026

Description

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.

Metrics

CVSS 4.0 8.4/10CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Red

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
OpengearIM7200>= 4.8, <= 5.5.2
OpengearCM7100>= 4.8, <= 5.5.2
OpengearACM7000>= 4.8, <= 5.5.2

References

Timeline

Published
Oct 31, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1022148.8Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-1022157.8Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1022167.8Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privilCVE-2026-1022178.8Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.CVE-2026-1022187.8Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1022198.1Inadequate encryption strength in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.CVE-2026-102225.6A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function _sanitize_env_linesCVE-2026-1022207.8Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.CVE-2026-1022214.4No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-1022248.4Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attackerCVE-2026-1022258.8Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-1022268.8Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to
CVE-2026-102212: High severity, CVSS 8.4 | Vulnix