CVE-2026-19509

MediumCVSS 6.5/10Last modified Sep 3, 2026

Description

Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
RDK	RDK-B WebUI	rdkb-2025q4-kirkstone

References

Timeline

Published: Aug 19, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-19519.8Delta Electronics AS320T has no checking of the length of the buffer with the directory name vulnerability.CVE-2026-195138.1The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to in CVE-2026-195157.0The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator project CVE-2026-195169.1A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool CVE-2026-195176.5Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open So CVE-2026-195186.5Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.CVE-2026-195194.3A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to p CVE-2026-19527.5Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.CVE-2026-19538.2Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-ed CVE-2026-195325.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversa CVE-2026-195347.5undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the CVE-2026-195358.6Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advan