CVE-2026-12495
A critical denial‑of‑service flaw exists in the web interface of the Mercusys MB115‑4G router. An attacker can send a crafted request to the /cgi/login endpoint, causing a stack buffer overflow that crashes the httpd process. The result is that the router’s web administration becomes unavailable until it is restarted.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mercusys MB115‑4G router – the web interface component.
Real-world impact
An unauthenticated attacker can render the router’s web management interface unusable, effectively denying remote configuration and monitoring until the device is rebooted or the service is manually restarted.
Why this severity
The CVSS score of 9.2 reflects a high impact on availability (the web service crashes), no authentication or user interaction required, and low attack complexity. The vulnerability can be exploited remotely with minimal effort, leading to a critical denial of service.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources