Denial-of-Service Vulnerability in Mercusys MB115-4G Device Web Interface
CVE-2026-12495

9.2CRITICAL

Key Information:

Vendor: Mercusys
Status: Mb115-4g
Vendor: CVE Published:; 27 July 2026

What is CVE-2026-12495?

A vulnerability exists in the web interface of the Mercusys MB115-4G device due to a stack buffer overflow in the http_gdpr_decrypt function. An unauthenticated attacker could exploit this flaw by sending a specially crafted request to the /cgi/login endpoint. This could lead to memory corruption, causing the httpd process to crash and resulting in a denial of service that affects the web administration service.

Affected Version(s)

MB115-4G 1.7.0 <= 1.9.0

References

https://www.incibe.es/en/incibe-cert/notices/aviso/stack-...

patch

CVSS V4

Score:

9.2

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 27, 2026
Vulnerability Reserved
Jun 17, 2026

Credit

Héctor Villar Palacios

CVE-2026-12495 Data

JSON