CVE-2026-12495

Executive Summary

CVE-2026-12495 is a denial‑of‑service (DoS) vulnerability in the Mercusys MB115-4G cellular router’s web interface, caused by a stack buffer overflow in the http_gdpr_decrypt function. An unauthenticated attacker can trigger this overflow by sending a specially crafted request to the /cgi/login endpoint, corrupting memory and crashing the httpd process. This renders the web administration service unavailable until the device is manually reset. No public exploit code or patch exists at this time, and the EPSS score is 0.0%, indicating very low active exploitation in the wild. The vulnerability is particularly concerning for IoT/OT environments where remote device management is critical.

CVSS Breakdown & Threat Level

Although no official CVSS vector was published, based on the description an unauthenticated, network‑reachable attacker can cause a DoS with minimal complexity. A reasonable estimate would be CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Base Score 7.5, High). The attack vector is Network, attack complexity is Low, privileges required None, user interaction None. Since only availability is impacted (no confidentiality or integrity), the scope is Unchanged.

Deep Dive & Mechanics

The http_gdpr_decrypt function is responsible for decrypting GDPR‑related request parameters in the login endpoint. It copies user‑supplied data into a fixed‑size stack buffer without proper length validation. By sending a POST request to /cgi/login with an oversized enc_data parameter (or similar GPDR field), the attacker overflows the stack buffer, overwriting the return address and other stack variables. This causes a segmentation fault in the httpd process, crashing the web server. Because the device does not automatically restart the service, persistent manual intervention is required to restore administrative access.

The vulnerability is likely due to use of unsafe functions like strcpy() or sprintf() without bounds checking. The embedded Linux system may lack modern mitigations (e.g., ASLR, stack canaries), making the overflow trivial to trigger.

Vulnerable vs. Patched Code

No official patch or source code is available, so a diff cannot be provided. Hypothetically, the patched code would:

• Replace unsafe strcpy/sprintf with strncpy/snprintf and verify buffer lengths.
• Validate the size of the enc_data parameter before processing.

// Vulnerable pseudocode:
void http_gdpr_decrypt(char *enc_data) {
    char buffer[256];
    strcpy(buffer, enc_data);  // no bounds check
    // decryption logic...
}

// Patched pseudocode:
void http_gdpr_decrypt(char *enc_data) {
    char buffer[256];
    if (strlen(enc_data) >= sizeof(buffer)) {
        // reject request
        return;
    }
    strncpy(buffer, enc_data, sizeof(buffer)-1);
    buffer[sizeof(buffer)-1] = '\0';
    // decryption logic...
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Requirements:

• A Mercusys MB115-4G device (or a similar model with the same firmware).
• Network access to the web interface (default IP: 192.168.1.1).
• Tools: curl, netcat, or custom Python script.

Triggering the DoS:

curl -X POST http://192.168.1.1/cgi/login \
  -d "enc_data=$(python3 -c 'print("A"*1000)')"

This oversized enc_data parameter will overflow the buffer and crash httpd. The web interface becomes unresponsive.

Verification:

• Ping the device: ping 192.168.1.1 (still responds to ICMP).
• Attempt to access: curl http://192.168.1.1/ → connection refused or timeout.
• httpd process is gone (check via telnet/SSH if available).

Blue Team (Defender)

• Detection: Monitor logs for repeated POST requests to /cgi/login with abnormally large payloads (e.g., Content-Length > 512 bytes).
• Mitigation:
  1. Restrict access to the web interface to trusted IPs only (e.g., firewall rules).
  2. Deploy a reverse proxy or WAF to inspect and reject oversized payloads.
  3. Update firmware as soon as a vendor patch is released.
• Recovery: If httpd crashes, the device must be physically power‑cycled or an administrator must trigger a reboot via serial console (if available).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /cgi/login with Content-Length > 512 (normal payloads are < 200 bytes).
  • Repeated requests from a single source IP within a short time window.
  • HTTP response: no response or 503 Service Unavailable after a successful crash.
• Host IOCs:
  • httpd process disappearing (check with ps aux if SSH access exists).
  • Kernel log entries: segfault at <address> ip <ip> error 6 in httpd.
  • Core dump file (if enabled) in /tmp/ or /var/crash/.

Detection Engineering

YARA Rule

rule CVE_2026_12495_httpd_overflow {
    meta:
        description = "Detects oversized enc_data payloads targeting Mercusys MB115-4G web interface"
        author = "Valters IT"
        date = "2025-04-11"
        cve = "CVE-2026-12495"
    strings:
        $payload = "enc_data=" nocase
        $overflow = /\?enc_data=[A-Za-z0-9+/]{512,}/ nocase
    condition:
        $payload and #overflow > 0
}

Sigma Rule

title: Mercusys MB115-4G Overflow DoS Attempt
id: 6b1d3e2e-c5a7-4f8a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects POST requests to /cgi/login with excessive enc_data length
author: Valters IT
date: 2025-04-11
logsource:
    category: webserver
    product: mercusys
detection:
    selection:
        cs-method: 'POST'
        cs-uri: '/cgi/login'
        cs-content-length: '>512'
    condition: selection
falsepositives:
    - None likely
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-12495 Mercusys httpd buffer overflow attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi/login"; http_uri; content:"enc_data="; http_client_body; byte_test:1,>,512; classtype:attempted-dos; reference:cve,2026-12495; sid:1000001; rev:1;)

Remediation & Mitigation

• Vendor Patch: None yet. Contact Mercusys support for firmware updates.
• Workarounds:
  • Access Control: Use firewall or router ACLs to allow only trusted management IPs to port 80/443.
  • Web Application Firewall (WAF): Deploy a WAF in front of the device to block requests with enc_data > 256 bytes.
  • Disable Remote Web Access: If not required, disable remote administration from WAN.
  • Monitor & Alert: Set up alerts for high Content-Length on /cgi/login.
• Hardening: Consider placing the device behind a VPN and only allowing local LAN access to the web interface.

Signature:
Valters IT – DevSecOps & Cyber Threat Intelligence Expert