EUVD-2026-49144

ID: EUVD-2026-49144

Severity: critical

CVSS v4: 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.

Timestamps

Normalized: 2026-07-27T12:15:41Z UTC
Last updated: 2026-07-27T12:15:41Z UTC

References

No references provided.

VulnAI

EUVD-2026-49144

Description

Timestamps

References