Uncontrolled Resource Consumption in RDK-B WebUI

Executive Summary

This vulnerability involves uncontrolled resource consumption in the file check.jst within the RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26. A remote attacker without authentication can exploit it by sending excessively large password values, leading to a denial of service condition.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves uncontrolled resource consumption in check.jst due to large password values. Monitor for unusual CPU or memory spikes during authentication attempts. Check web server logs for repeated failed login attempts with abnormally long password fields. Inspect network traffic for POST requests to /check.jst with excessively large payloads.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to disrupt the availability of the RDK-B WebUI service by consuming excessive server resources. This can result in the service becoming unresponsive or crashing, affecting legitimate users' access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a denial of service via resource exhaustion in a web interface component. Compliance impacts would depend on how the affected system is used in a regulated environment rather than the vulnerability itself.

Useful 0 Not Useful 0

Mitigation Strategies

Update to a patched version of RDK-B WebUI beyond rdkb-2025q4-kirkstone.04.10.26. Monitor network traffic for unusually large password values sent to check.jst. Implement rate limiting on authentication endpoints.

Useful 0 Not Useful 0