CVE-2026-122013

Summary

A path traversal flaw in the Multipart Parser component of the /usr/bin/webmgnt binary allows unauthenticated remote attackers to read arbitrary files on the device by manipulating the filename argument in a multipart request.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible and a public exploit exists.

Blast radius

Complete compromise of confidentiality, integrity, and availability due to the CVSS 10.0 score, enabling full device takeover, credential theft, and lateral movement within the network.

Detection

Look for HTTP requests containing '..' sequences in multipart filename parameters to the /webmgnt endpoint, especially with non-standard file extensions or attempts to access sensitive paths like /etc/passwd or /etc/shadow.

Prioritized remediation

Upgrade to firmware version 2.6.0.2 or later if available; otherwise, immediately disable or restrict access to the /usr/bin/webmgnt endpoint and monitor for exploitation attempts.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.