What is CVE-2026-12495?
CVE-2026-12495 is a Denial-of-Service (DoS) vulnerability caused by a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker can exploit this by sending a specially crafted request to the /cgi/login endpoint, leading to memory corruption. Users are advised to update the device firmware to the latest version to mitigate the risk.
Azərbaycanca: CVE-2026-12495, Mercusys MB115-4G cihazının veb interfeysində http_gdpr_decrypt funksiyasında stack buffer overflow nəticəsində yaranan Denial-of-Service (DoS) zəifliyidir. Doğrulanmamış təcavüzkar /cgi/login nöqtəsinə xüsusi hazırlanmış sorğu göndərərək bu zəiflikdən istifadə edə bilər ki, bu da yaddaş pozulmasına səbəb olur. Bu boşluqdan qorunmaq üçün cihazın proqram təminatını ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-119
FAQ2
In which function of the Mercusys MB115-4G device was the CVE-2026-12495 vulnerability discovered?
This vulnerability is caused by a stack buffer overflow in the http_gdpr_decrypt function of the device's web interface.
What should be done to mitigate the CVE-2026-12495 vulnerability?
It is recommended to update the Mercusys MB115-4G device firmware to the latest version to mitigate this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.