PT-2026-64875 · Mercusys · Mb115-4G

CVE-2026-12495 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mercusys MB115-4G (affected versions not specified)

Description A denial-of-service (DoS) issue exists in the web interface due to a stack buffer overflow—a condition where a program writes more data to a buffer located on the stack than it can hold, potentially overwriting adjacent memory. An unauthenticated attacker can trigger this by sending a specially crafted request to the '/cgi/login' endpoint, which affects the http gdpr decrypt() function. This leads to memory corruption and causes the httpd process to crash, making the web administration service unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-12495

Affected Products

Mb115-4G

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12495 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/stack-based-buffer-overflow-mercusys-mb115-4g · Patch
• https://t.me/CVEtracker/61319 · Telegram Post