Improper Cryptographic Signature Verification in RDK-B WebUI

Executive Summary

Improper cryptographic signature verification in jst_functions.c in RDK-B WebUI allows a remote attacker to bypass authentication and gain administrative access by forging a JWT with an invalid RSA signature.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the WebUI component for improper JWT signature verification in jst_functions.c. Check if the system uses RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 or similar. Monitor for unauthorized administrative access attempts or forged JWT tokens.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass authentication, gain unauthorized administrative access to the device, and potentially modify configurations or access sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access control.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the RDK-B WebUI to a patched version that fixes the improper cryptographic signature verification. Disable unnecessary administrative access and review all JWT tokens for validity. Implement network monitoring for suspicious authentication attempts.

Useful 0 Not Useful 0