{"id":"CVE-2026-102212","kind":"vulnerability","aliases":["CVE-2026-102212"],"related":[],"title":"Opengear console servers: overflow lets remote attacker crash index.cgi","description":"Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.","summary":"Opengear IM72XX, CM71XX and ACM70XX console server firmware versions 4.8.0 through 5.5.2 contain a heap buffer overflow in the web interface. An unauthenticated remote attacker can send a crafted multipart POST to crash the index.cgi process.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["console-server","firmware","infrastructure","network-appliance","opengear"],"not_affected_if":["firmware-outside-4.8.0-5.5.2","management-interface-not-reachable"],"how_to_check":"- Check the firmware version on the appliance (IM72XX, CM71XX, ACM70XX) against the affected range `4.8.0` through `5.5.2`.\n- Confirm whether the web management interface (index.cgi) is reachable from untrusted networks.","fix":"- Firmware versions `4.8.0` through `5.5.2` are affected; the NVD entry does not state a fixed version.","status":"open","published_at":"2026-10-31T16:16:52+00:00","first_seen_at":"2026-10-31T16:36:24+00:00","triaged_at":"2026-10-31T16:37:08+00:00","updated_at":"2026-10-31T16:37:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-31T16:37:08Z","model":"claude-haiku-5-5","output":{"fix":"- Firmware versions `4.8.0` through `5.5.2` are affected; the NVD entry does not state a fixed version.","reach":"network","title":"Opengear console servers: overflow lets remote attacker crash index.cgi","impact":"medium","summary":"Opengear IM72XX, CM71XX and ACM70XX console server firmware versions 4.8.0 through 5.5.2 contain a heap buffer overflow in the web interface. An unauthenticated remote attacker can send a crafted multipart POST to crash the index.cgi process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["opengear","console-server","firmware","network-appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the web management process remotely without credentials.","analyst_note":"Confirm fixed firmware version and whether the overflow permits more than a denial of service; check Opengear advisory linked from NVD.","how_to_check":"- Check the firmware version on the appliance (IM72XX, CM71XX, ACM70XX) against the affected range `4.8.0` through `5.5.2`.\n- Confirm whether the web management interface (index.cgi) is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["firmware-outside-4.8.0-5.5.2","management-interface-not-reachable"],"who_is_affected":"Teams running Opengear IM72XX, CM71XX or ACM70XX console servers on firmware 4.8.0 through 5.5.2 whose web interface is reachable by an attacker. The sources describe a crash of index.cgi, not code execution, and do not say whether the web interface is exposed by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4161,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102212':12A,15A '-2026':11A,14A '4.8.0':34B,74C '5.5.2':36B,76C 'acm70xx':29B,71C 'allow':81C 'applianc':23B,80C 'attack':7A,49B,85C 'base':63C 'buffer':40B,64C 'cm71xx':27B,69C 'consol':2A,17B,30B,78C 'console-serv':16B 'contain':37B,97C 'content':101C 'content-disposit':100C 'craft':53B,93C 'crash':8A,57B,87C 'cve':10A,13A 'disposit':102C 'field':104C 'firmwar':19B,32B,72C 'heap':39B,62C 'heap-bas':61C 'im72xx':26B,68C 'index.cgi':9A,59B,89C 'infrastructur':20B 'interfac':45B 'let':5A 'multipart':54B 'multipart/form-data':94C 'name':103C 'network':22B 'network-appli':21B 'opengear':1A,24B,25B,67C 'overflow':4A,41B,65C 'overlong':99C 'post':55B,95C 'process':60B,90C 'remot':6A,48B,84C 'request':96C 'send':51B 'server':3A,18B,31B,79C 'unauthent':47B,83C 'version':33B,73C 'via':91C 'web':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running Opengear IM72XX, CM71XX or ACM70XX console servers on firmware 4.8.0 through 5.5.2 whose web interface is reachable by an attacker. The sources describe a crash of index.cgi, not code execution, and do not say whether the web interface is exposed by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T16:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Red","cvss_by":"e8a6bb0b-e373-42b1-a5de-93e314325576","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102212","severity":null,"published_at":"2026-10-31T16:16:52+00:00","modified_at":"2026-10-31T16:16:52+00:00","first_seen_at":"2026-10-31T16:36:24+00:00","fetched_at":"2026-10-31T16:36:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}